First, to clarify: what I meant by &quot;your&quot; was an entity like a standards community, not an individual, and by &quot;often&quot; I meant within a timeframe that makes bruteforcing parameters infeasible (which itself changes over time wrt the size of the parameters).  Key rotation for example is just good practice.<p>Nothing that I said was wrong - nor does it contradict Colin&#x27;s advice - and while simple systems are better, that&#x27;s a tradeoff that should be made if you care about entities with lots of resources like e.g. the NSA.  As history shows, bad parameters (or parameters that are feasibly bruteforced over a particular timeframe) are not an &#x27;unlikely&#x27; weakness.  Besides, being aware of potential vulnerabilities - especially those that you know pose real threats - and not addressing them is simply bad practice.