How to AES Encrypt in .NET without an IV

Question

We have a legacy part of our Classic ASP application that use some code which is supposed to encrypt/decrypt strings with Rijndael (AES). This code was found on the Internet here (Rijndael AES Block Cipher (VB Version)). I already found a question on SO that references this exact library and which ask almost the same thing as me, but I suspect at least one thing that goes wrong (other than adding the length of the data to encrypt at the beginning of the bytes array). The vbScript implementation does not look like to add an IV at all to the data to encrypt. So, I am not able to match the same encryption with RijndaelManaged since it :

1. automatically generates a different IV every time
2. absolutely requires an IV

Does someone knows if it is possible to AES encrypt something in .Net without specifiying an IV (empty) ?

Answer 1

Both the code you are using and the solution to your problem are completely insecure. First, *YOU SHOULD NOT UNDER ANY CIRCUMSTANCES USE A CRYPTO LIBRARY SOME RANDOM GUY WROTE * Period, end of story. Both windows and .net have trusted, vetted, encryption libraries. They don't have things like timing attack issues, out right backdoors, or just moronic things that would be attempted by no one who knew anything about crypto.

Case in point, the library you mention, appears to only support ECB mode. This is completely insecure and no one who knew what they were doing would do it. Although there are a bunch of reasons for it, the best demonstration fo why not to do it is this :

This is an ecb encrypted picture of the linux penguine. Not very secure is it?