What can an attacker reasonably guess?
The type of system we are using?
The uses we are putting it to?
The hardware we are using?
How we are doing key management functions?
One of our users’ passwords?
The combination to the front door?
The person who knows the information being encrypted?