AES-256-CBC with random IV - storing same plaintext as same ciphertext

Question

I am encrypting some information stored in a column of a MySQL database. The column can contain repeated values, let's say the table has 7 rows and the column to be encrypted has the following values:

"a", "b", "a", "c", "b", "b", "c"

I would like to know if is insecure to encrypt just one time each different value (each one with a random IV stored along with the ciphertext) and to reuse the same ciphertext for the same plaintext.

Let's say that the encryption of "a" with a random IV (IV1) gives "z", the encryption of "b" with another random IV (IV2) gives "x" and the encryption of "c" with another random IV (IV3) gives "k". Would it be insecure to have all the "a"s encrypted as "z", all the "b"s encrypted as "x" and all the "c"s encrypted as "k"?

"z", "x", "z", "k", "x", "x", "k"

I often read that it is a weakness to have the same ciphertext for the same plaintext, but I was wondering if this weakness is no longer present if you use a random IV each time to encrypt the data.

Thanks for your help.

Answer 1

I often read that it is a weakness to have the same ciphertext for the same plaintext, but I was wondering if this weakness is no longer present if you use a random IV each time to encrypt the data.

The weakness is still present. It would be mitigated if, for equal plaintexts, you generated different random IVs when encrypting. Using different IVs for equal plaintexts would then yield different ciphertexts.

Why would you want different ciphertexts? Consider the scenario where you have a database with two columns, a VARCHAR username and a BOOLEAN has_some_horrible_disease. Suppose you encrypt the has_some_horrible_disease column for privacy purposes using the scheme you describe. One day an attacker compromises the database and has access to all the data. Suppose the attacker knows that username "johnsmith" has a value of "true" for has_some_horrible_disease (this is not farfetched, all they have to do is e.g. create an account and set their data to the target values).

The issue is that you just leaked the has_some_horrible_disease values for every single user! Why? Because the encrypted value for user "johnsmith" is the same for every other user who has has_some_horrible_disease set to "true". In other words there's a 1-to-1 mapping from encrypted value to cleartext value. If you used a random IV this would not be the case, every value in has_some_horrible_disease would be unique to that row (with extremely high probability).