AES CBC: Use hash of key as IV when every key is unique? I have an app that uses a different random key for every file that is being encrypted.

Am I correct in assuming that this means that I can safely use a hash of the random key as the IV, because that would also lead to a unique IV?

If possible, I would prefer to not store the IV along with the file for performance and storage reasons. OTOH, I obviously don't want to compromise on security...

Thanks for your advice
Yes, that would be an excellent idea, at least if you use a cryptographically secure hash that has output indistinguishable from random. That's however true for most secure hash algorithms out there. You could - for instance - use SHA-256 and then take the leftmost 128 bits; using the leftmost bits is more or less the industry standard.

You cannot derive the key if the IV gets known because the hash is one way, and an adversary cannot predict the IV because to do that the key should be known. One possible issue is that hash algorithms are not always protected against side channel attacks. Then again, most hash algorithms are not directly susceptible to them either.
Beware that you should document that the resulting IV is static, if you ever start reusing the keys then you'd be in trouble.



Alternatively you could use a KDF to derive two values from a master secret, say S. For instance, you could use K = KDF(S, "Key", 128) and IV = KDF(S, "IV", 128) to derive both the encryption key and the IV from one input value.

K | IV = KDF(S, "KeyAndIV", 256) is also often used - it is for instance similar to key derivation in TLS 1.2. This is provably secure and may require less computation time than doing the KDF twice.

The resulting key and IV when using a KDF over a secret value do not depend on each other. This is more secure than having the IV being dependent on the key. A good KDF for key based key derivation (KBKDF) is HKDF.