In general, the value used as an IV with symmetric algorithms
need not be protected against disclosure. In some instances it is
Curiously enough, the NSA rules for "expedited" export clearance (when
using RC2 and RC4) *require* that the IV be visible in plaintext, not
enciphered under the session key.
The NSA also recommends to people who ask, that you put a validation
string right up front in the message, under the encryption, which can
be checked by the recipient to verify that the decryption produced a
valid result.
Of course, both of these also happen to help people who have
precomputed all possible encryptions for quick search...but we don't
know anyone like that.
John