Basically, you don't cypher the usernames because it is useless. Think about usernames: most of them are short, concise, common and even public. It will take n

Basically, you don't cypher the usernames because it is useless. Think about usernames: most of them are short, concise, common and even public. It will take no time to decypher with a tailored dictionary attack. So, at the end, if you cypher the usernames you are adding complexity to a system adding none or very little extra security. Worthless effort.