Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Essentially, I'm wondering if an octet stream is, by its nature, secure without knowledge of a semantic meaning for the bytes being sent. If you have no knowledge of the processing at either end of the stream, is there any way to get information from it?

share|improve this question

3 Answers

up vote 3 down vote accepted

Real-life data has a lot of structure which makes recognition easy. The Unix file utility has done so since 1973.

Not being able to figure out the ins and outs of a bunch of bytes means that the bytes are not distinguishable from random, unless you know a "secret convention" which governs the interpretation of said bytes -- this exists and is called encryption. Decades of research in cryptography have come to the following conclusion: encryption can exist, but it is not easy. If you do not apply encryption explicitly, then the meaning of the data is not secret but, at best, obscure. Experience shows that obscurity rarely lasts long.

share|improve this answer
Ah, I see. So the idea is that in practice the stream will contain something like XML or JSON which is easily recognizable by the structure and order of the bytes if it's unencrypted? – Jeff Feb 12 at 16:47
Yes. Even data in compressed formats (e.g. JPEG pictures) will begin with a recognizable header. – Tom Leek Feb 12 at 17:43
up vote 2 down vote

This would be known as Security by Obscurity, and I wouldn't count that as security.

The ability to derive information from a given stream depends on the protocol or technology that created it, nothing more or less.

To keep information private, you'll need to use an encryption algorithm. Even with an algorithm applied to your stream, it could be insecure depending on where the stream is. Is the stream on disk, or is the stream on the network?

Often times if the encryption itself isn't broken, the key exchange is. Depending on the value of what you're protecting in the arbitrary stream of bytes, it may or may not be worth it for a black hat to decipher your stream.

Given enough time and motivation, any non-standard cryptography will be broken quickly.

Also see this link...

share|improve this answer
up vote 1 down vote

BobBarker04011950PriceIsRightLosAngelesCalifornia

Is that secure? Particularly if you can manipulate the input and see the output, it is trivial to determine the meaning of a data stream unless encryption is placed on the data.

share|improve this answer
Right, that makes sense. I guess I was thinking that because you don't know the format of the bytes, including the beginning or end points of the data, that getting any semantic information would be difficult. But the more I think about it, I suppose that's extremely naive. Still trying to learn about all this stuff. :) – Jeff Feb 12 at 17:07
@Jeff - yeah, don't feel bad. It's an incredibly common mistake that people make when they are first trying to secure stuff. I can't tell you how many system's I've seen that rely on similar types of obfuscation only to be surprised when it falls flat on it's face the first time someone actually attacks it. – AJ Henderson Feb 12 at 19:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.