Always assume the attacker knows your scheme, but not your random bits.