3. They should be authenticated.
To OP, I would suggest using secretstream from libsodium, which abstracts all these problems away for you.
To OP, I would suggest using secretstream from libsodium, which abstracts all these problems away for you.
I covered that:
> Furthermore, not authenticating your ciphertext means padding oracle attacks can be launched against the app.
The list above was just the requirements for the initialization vector, not the list of problems with the code.