In which cases should the IV be kept secret? When must an IV be kept secret?

There is an ambiguity in the way that the lack of need for secrecy of the IV is described in multiple places.  Does this ambiguity suggest that there are, in fact, situations in which the IV must be kept secret?  Or is it a quirk of language that has persisted across several popular sources?

The (ISC)2 Guide to the CISSP states (emphasis mine):


  There is no need for the IV to be secret, in most cases, but it is
  important that it is never reused with the same key.


Crypto.StackExchange:


  IV usually does not need to be secret, However, in most cases, it is important that an initialization vector is never reused under the same key.


Wikipedia:


  An initialization vector has different security requirements than a key, so the IV usually does not need to be secret. 


I understand the role the IV plays and the reasons that is is generally considered to be non-secret information.  I am curious if there are situations in which it must be treated as secret information, or if this is merely a linguistic no-op that has gotten repeated.
Normally, in a properly designed cryptographic system, everything that must remain secret is either actual data (and the system exactly aims at preserving that confidentiality) or a key. Everything else ought to be public or at least publishable with no ill effect, as per Kerckhoffs' principle.

Now it so happens that a number of cryptographic systems are expressed as iterative processes, starting with an "initial value" (or "initialization vector"), i.e. an "IV". It is conceivable that in such a system, the IV is a key. A contrived example would be a hand-made stream cipher with a hash function:


A state s is initialised to some value.
The stream cipher produced pseudo-random bytes by repeatedly hashing s: the first bytes of output are H(s), then H(H(s)), and so on.


Such a stream cipher is then an iterative process that repeatedly produces the next value of the "running state" by hashing that state. The starting value for the state is thus an initial value in the strict sense of the term, and is also the key for the stream cipher, hence the need for secrecy.

This is, however, a quite contrived example. This stream cipher is atrociously weak in several ways (don't use it!). In a properly designed cryptographic system, we really prefer it when keys are reusable: keys that can be used only once tend to imply issues (it was one of the problems with RC4). Instead, we prefer keys that can be used several times (e.g. to encrypt several messages), possibly along with other values that need not be secret, but must be changed each time. This is what normally happens with encryption system: a secret key, that can be reused for several messages, and a per-message "nonce" that must be generated anew for each message, but needs not be secret; hence, the nonce can be transmitted along with the message. The "IV" in most encryption systems fulfils this "nonce" role.



In a more conceptual point of view, the notion of "IV" is not precisely defined. Thus, expressing an absolute such as "IV never need to be secret" is bound to anger somebody, somewhere, would used an IV in a slightly exotic way and found a situation where something can be called an "IV" and still requires secrecy. Using a phraseology like "usually" or "in most cases" is a simple way to avoid triggering an acrimonious debate.