I would like to use AES-CTR to encrypt the same plaintext with the same key more than once (on different machines). I'm wondering whether I should try to use the same IV each time, or whether it's safe to use a random IV for different instances of the same plaintext. Using the same IV would require a deterministic method for IV selection, which poses its own problems.
I've seen very good explanations of why one shouldn't re-use a key/IV pair when encrypting different plaintexts using AES in CTR mode. (https://crypto.stackexchange.com/a/2993/83956)
I'm wondering whether encrypting the same plaintext twice with the same key but a different IV opens you to a similar attack. As I understand it, this would provide an attacker with
$C_1 = P \oplus F(K, IV_1)$
$C_2 = P \oplus F(K, IV_2)$
$C_1 \oplus C_2 = F(K, IV_1) \oplus F(K, IV_2)$
...which doesn't look useful to me, but that depends on $F$ which I'm not familiar with.
Context: I have a system which requires a password and secret key together in order to log in. In a web client, I would like to save the secret key in local storage for convenience. I understand it is bad practice to leave secrets unencrypted in local storage, so I'm encrypting it with AES-CTR using a key generated from the user's password. The encrypted key will never be transmitted—only decrypted using the password for login purposes. They key is compressed before encryption, so any guesses at the password cannot be validated by attempting to decrypt the secret key. All guesses produce valid-looking secret keys, so an attacker would still have to use actual login attempts to brute force anything.