I have a system that encrypts messages for a given user using key K using AES-CBC in response in an external stimulus. Each message has a randomly generated IV. The user never decodes these messages, they are used as opaque token.
Under certain circumstances it is possible Mallory can observe the system and infer that two messages (M1, M2) have identical plaintext (P). My concern is given two messages that are known to have identical plaintext and same key, is it possible to recover the K?
IV: randomly generated IV one block size.
IV1 + E(K, P, IV1) => M1
IV2 + E(K, P, IV2) => M2
If it possible to recover K, what mitigations could I put in place? For example would a nonce within the plaintext help, i.e.:
IVx + E(K, (Nx + P), IVx) => Mx
How would I calculate the size of nonce determine computational difficulty for recovery (within P there is a CRC32 to determine tampering)?