I have multiple RFID tags which I want the data stored on them to only be read by certain users when scanned. What I did was basically to encrypt the data with a key using CBC mode, take the encrypted hex data and append it with the IV, and then put this whole string into the tag.
So, each tag will have a different IV but their data is encrypted by the same key.
Basically, Tag A is assigned with $IV_A$ and Tag B is assigned with $IV_B$, same for Tag C, D and so on. I would pre-encrypt the data on my computer, append the IV to the back of the encrypted data, and then transfer the whole string into the tags. The different data for each of the tags will all be encrypted with the same key. So, the data in Tag A would contain $EncryptedMsg_A+IV_A$. In Tag B, the data in it would look like $EncryptedMsg_B+IV_B$.
The IVs are appended in clear text behind the encrypted data. $IV_A$ will remain unchange as the IV of Tag A for as long as it is around. And $IV_B$ will remain unchange as the IV of Tag B too.
The users wouldn't be writing to the tag. They will only be reading from the tag.
However, the part where IV remain unchanged on each scan and exposed makes me feel uneasy about this method.
Will this method be sustainable to attackers? Should I have another key to encrypt the IV before appending to the encrypted data? Would it be stronger this way?