How is it possible to optimize for back-end performance without potentially leaking information?

Also, doesn't a variable key length improve the situation overall and reflect a more standard implementation?