I am making a call with parameters from application "A" to a web application "B". Parameters are in the query string of the URL. They don't need to be hidden. But I want to be sure that nobody can change the parameters. And web application "B" must ensure that the query comes from application "A".
So, I encoded the parameters in AES with CBC. I know that HMAC is best for this kind of situation. But AES with CBC is the only one algo that the 2 applications have in common.
The security of the system relies on the fact that nobody in application "A" can choose arbitrary plaintext to be encrypted (to avoid request with modified parameters). Parameters are not an input for the users.
I would like to know the risk if I use a fixed IV or a predictable IV?
It seems that the risk is a chosen plaintext attack.
With this article:
I understand how chosen plaintext attack can lead to reveal the content of the ciphertext.
But I don't mind if the content of the ciphertext is discovered.
What are the other risks?
Can someone build unauthorized request? CWE-329 says yes. But does that only imply the reusing and adaptaptation of blocks of older messages? Or does the attacker can build his own request with whatever plaintext he wants?
Does the secret key can be discovered? From Wikipedia it seems that chosen plaintext attack can reveal the secret key, but I don't understand how.