Really cool writeup, thanks! I think one key point is a bit shaded in the long discussion -- if you have the key, you've decrypted the message. The rest is jus

Really cool writeup, thanks! I think one key point is a bit shaded in the long discussion -- if you have the key, you've decrypted the message. The rest is just details from a crypto perspective (but again, don't get me wrong, the practice is different and this is a great walk through). On the IV I also think the description is a bit unclear. IV must be a nonce (i.e. number used only once), and it is public (i.e. known to the attacker in security proofs). It is usually random just because it's likely to expect that many random numbers will always be different.