@bananas Isn't a content-derived key scheme inherently secure against those types of attacks (as long as the hash function is)? As there is no way to obtain different ciphertexts from the same key