Exercise 2: Reusing the Same IV in CBC Mode — Possible Solution
====================================================================

Per the chapter's own CBC formula:

    Ciphertext_1 = AES( Plaintext_1 XOR IV )

If the SAME key and SAME IV are used for both messages, and the first
block of plaintext (Plaintext_1) happens to be identical in both
messages, then:

    Message A, Block 1: AES( P_A XOR IV )
    Message B, Block 1: AES( P_B XOR IV )

Since P_A = P_B in this scenario, both expressions are computing
AES() over the exact same input (the same plaintext block XORed with
the exact same IV) -- which means both produce the EXACT SAME
ciphertext block as output.

What the attacker observes: comparing the two ciphertexts, the FIRST
BLOCK is identical in both. Every block AFTER the first will very
likely differ (assuming the rest of the two messages differ), because
each later block depends on the previous block's ciphertext, which
diverges as soon as the plaintexts themselves diverge -- but the
first block alone already leaks something real.

What this leaks: the attacker learns, with certainty and without any
decryption at all, that the two messages START WITH IDENTICAL CONTENT
for at least one full block's worth of plaintext. Depending on context
(for example, if messages always begin with a predictable field like
a account number or a message type), this can reveal real information
-- e.g., that two different users' first messages both used the exact
same opening template, or that a resent message is identical to an
earlier one.

WHY THIS WORKS AS AN ANSWER
------------------------------
This is a smaller-scale version of the exact same fixed-mapping
weakness the chapter describes for ECB and for CTR's nonce reuse --
the chapter's own warn-box states that "a reused or predictable IV
reintroduces exactly the kind of pattern leakage ECB has, at least for
the first block of a message," and this exercise derives precisely
why that's true algebraically, rather than just citing the rule: the
IV's entire job is to make the first block's encryption unique per
message, and reusing it removes that uniqueness completely for
whichever messages happen to share the same starting plaintext.