[gwern]

> no open IP logging taking place (IP addresses associated with submissions are stored in the DB in an encrypted format).

Given how small the IP space is, does that actually add anything?

[MichaelGG]

With a random IV and CBC, is it actually not secure? Assuming you have the encrypted entries, and can even create more on-demand, what can you do besides brute force the key? Plus, almost any 4-byte result is a valid result.

[gwern]

I'm not sure, but OP didn't mention using random IVs or CBC.