We do keep the IV inside the mode, but when building the actual cipher context for OpenSSL we need to supply IV/nonce for EncryptInit/DecryptInit.

dstufft: Are you aware of any modes where EncryptInit/DecryptInit take something other than char * or null? IVs (CBC, OFB, CFB, GCM, CCM) and nonces (CTR) can just be passed as char * and ECB will just get null.

GCM/CCM have weirdness around setting tag length using ```EVP_CIPHER_CTX_ctrl``` and adding authenticated data, but that would be handled after instantiating the context.

alex: Is ```get_initialization_vector_for_ecb``` on API so that ECB itself doesn't need to know what an FFI null is?