In a system where personal information stored in a database is encrypted, but one of the fields only contains data in a minority of cases, would it make more sense to leave the field empty, rather than encrypting an empty string?
On one hand if I choose to leave the field empty, I would be leaking information about the contents of the record (populated or not)
On the other hand, if I encrypt the empty field, most of the time I am giving a potential attacker a known plaintext.
The algorithm being used is AES-256.
I'm aware that an attacker would still have to brute force the key even if they obtained a ciphertext/plaintext pair, however I'm curious what the community feels the best practice approach would be here.