This question already has an answer here:
I'm looking at a datagram-based protocol that encrypts a payload. The payload is encrypted with AES or blowfish in CBC mode, and the result is then authenticated with a HMAC.
To save space, the protocol uses a zero IV, but prepends a special prefix to the data before encryption.
The prefix consists of 12 random bytes, followed by a unique sequence number that isn't reused for the same key.
In summary, the datagram payload basically looks like this:
HMAC(12+ bytes) CBC-ENCRYPT (IV=0, RANDOM(12 bytes) SEQUENCE(4 bytes) REAL_DATA)
My question is, is there an obvious flaw to this construct? As I see it, it basically is like normal CBC, but instead of a fully random IV, it uses ECB-ENCRYPT(random + sequence) as (effective) IV.