1

TLDR; Are there precedents saying not to obfuscate encrypted data?

If I'm using some standard, and a client is using the same standard, the only thing we pass back and forth is the key. This is how standard encryption works.

But is there any documentation for or against obfuscating the data further? Thus making it essentially worthless unless you have the key and ALSO know how to un-obfuscate the encrypted data?

6

Obfuscation is generally not useful as a security feature or enhancement of encryption.

That said, there are reasons to use obfuscation, but it's generally in regards to attribution rather than security.

A classic example would be using steganography to hide your encryption. The purpose is not to enhance security, but to hide the fact that you are communicating at all. Another example would be using obfuscations like "meek", and others, to hide the fact you are using Tor.

Depending upon your intent and environment, using obfuscation with encryption could range from pointless inconvenience to extremely important.

  • 2
    Essentially, obfuscation shouldn't be used to try to make the encryption more Encrypted, because you should either trust your encryption or use a different one. But obfuscation can be used as a different measure to hide intent or details about the process at large. Though, as you say, there could be a user for that, or it could be an extra unnecessary step. Do I understand your answer? – Suamere Jul 25 '19 at 3:57
  • @Suamere - Yes, exactly. – user10216038 Jul 25 '19 at 14:36
3

Yes. It's called Kerckhoffs's principle, and it states:

A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

For obfuscation of data to be effective you must expect that the attacker does not know the system, which is in violation of the above principle.

  • 4
    OP is asking about combining both encryption and obfuscation. That's not against Kerckhoff's principle – Mr. E Jul 25 '19 at 1:00
  • I agree with the statement of this post, but Mystery is right, I don't see any shortcomings with the encryption system. That alone is secure. Obfuscation could have other uses, though I don't want to "lead the witness" per se. – Suamere Jul 25 '19 at 4:00
  • @Mr.E The obfuscation part is. The encryption is fine. – Polynomial Jul 25 '19 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.