0

Assuming whatever encryption algorithm used was designed to support compression without any information leakage, would there be any reason not to use some custom compression algorithm to add obscurity to security?

Instead of a compression algorithm, what if it were just a simple custom algorithm that mixed the bits or bytes of the input? Would that impact the security at all?

(This is assuming that the implementation of said algorithm is secure against side-channel attacks.)

Improve this question
4
  • 1
    Aren't you basically asking that using some unspecific "without any information leakage" and "no side-channel attacks" transformation of the data has any negative impact on security? How about simple bugs in the implementation of your decompression algorithm like buffer overflows which might be used to attack the machine doing the decryption? In general: adding anything adds complexity and thus increases the likeliness of bugs.
    – Steffen Ullrich
    Aug 15, 2020 at 12:53
  • @SteffenUllrich, thanks for the response. That makes sense. The "without any information leakage" and "no side-channel attacks" had been meant to say that the machine was physically secure (and I must admit, I don't really know that much about information security; I was curious about why people don't add random obscurity).
    – mwpuppire
    Aug 15, 2020 at 13:03
  • The fact of doing compression itself can be a relevant side-channel, see CRIME attack. "...why people don't add random obscurity..." - again, additional complexity means additional bugs. And randomness is already part of most encryption algorithms in the form of an Initialization Vector.
    – Steffen Ullrich
    Aug 15, 2020 at 13:26
  • 2
    The primary reason to compress before encrypting is because attempting to compress after encryption will generally not result in much compression. It isn't performed to add security.
    – Tim Campbell
    Aug 15, 2020 at 13:29

1 Answer 1

Reset to default
0

Obscurity does not give you additional security, hiding a key to the door does not make your lock stronger especially if you're dealing with someone trying to pick it.

Compression prior to the encryption is only to make the input smaller which has a significant impact on the performance of the asymmetric crypto it is also handy when you need to transfer the files on the wire as they're smaller. If you mix your input or output then you need to provide the user with the way of undoing the "mixing" which could be obtained by the adversary rather easily. If you consider making this operation secret, then the question would be, why not use a one time pad instead?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .