What is the best practice to save encryption and decryption method in an application?

Question

Almost all the application regardless of their nature and purpose are using encryption to secure sensitive data to be saved to database, if the user using a method to encrypt a file (for instance an image) and save the binary data to database and later decrypt it to display it to end user, what are the best practice to save encryption and decryption methods in application?

I know that I have to use different salt or password for each file to be encrypted however when it comes to storing and reusing encryption and decryption methods, it becomes a security thread if somebody get access to file containing methods...

I am also very well-aware that writing a custom encryption method probably is not a wise solution since it needs knowledge and experience information security so in this case is there any suggestion to mitigate the risk of accessing these methods by unauthorized people??

Answer 1

If by "encryption method" you mean the cryptographic scheme used to encrypt/decrypt the data, then there shouldn't be any problem for them to be public. In fact, if you're doing it correctly, you should already be using something well-vetted like AES.

Always keep Kerckhoffs's principle in your mind

• A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

• The cipher method must not be required to be secret, and it must be able to fall into the hands of the enemy without inconvenience.

The only thing that needs to be secret in your encryption scheme is the key.