Assume the following structure:
version | iv | ciphertext | HMAC(version | iv | ciphertext | ..., key)
version starts out to be a "random" 64-bit number. It identifies the key used to encrypt the ciphertext for the purpose of key rotation (
version is not, nor does it contain any part of the key). For every message encrypted by the same key,
version is the same. The rest of the text, starting with a random
iv, is always different.
Is there any reason I need to protect
version? If an attacker knows the version the most they can do is identify a group of ciphertext that was encrypted with the same key.
The ciphertext itself has validity period of it's own. The data should be updated around the same time as the key is rotated. The rational behind
version is to allow the ciphertext to be updated gradually as-needed.
Would obscuring the
version in some way add any benefit, even small? Something like this:
$Version_n \oplus Hash(iv)_n$
I know this adds no real security benefit. If
version doesn't need to be protected, the most I'm going for is to make it appear random.