Good encryption, bad assumptions ...