How safe is it to use older/unknown Encryption methods for plaintext?

Question

When mailing or chatting with people, it had crossed my mind, what if, for simple communication, someone would use an older encryption method (i.e., ENIGMA), to encrypt their message?

Would because of the uncommon method and name of the encryption, it be harder for eavesdroppers to understand what method is used? thus harder to decrypt messages?

In short: Is it "safe" to use an Unknown or Older encryption method to encrypt messages due to its uncommoness?

The encryption method is without doubt unsafe due to it's simplicity, but still takes some work to crack, if i'm right.

Answer 1

Your method cannot be completely unknown, since both sender and receiver know it. Moreover, they run it; so either it is simple enough that they use it in their heads, or it exists as some piece of additional software, in which case the method is also known to their hard disks, the method designer and implementer, and github.

In fact, unknown methods do not exist.

Old encryption methods, however, do exist, but they are cumbersome to use and invariably inefficient. Enigma had no character for space... In his time, Edgar Allan Poe had made a specialty of breaking substitution ciphers, and boasted that none could resist the onslaught of his magnificent brain (to my knowledge, he was not proven wrong in this time).

Actually there is one old method that would ensure security: the good old One-Time Pad. But using it properly requires having, indeed, random pads at hand. Both sender and receiver would have to keep a booklet of random pad on them, and dutifully cross out the used elements. If you hold the book in your left hand and the pencil in the right hand, you will need to strap your smartphone on your knee and enter the message with your nose. Physical comedy notwithstanding, I fail to see how this could qualify as usable.

Answer 2

This is security by obscurity. It's bad practice, and it will basically only require your attacker to have some motivation & time to spend in order to identify/analyze your cipher. After that, it's basically game over, "old crypto" is pretty much trivially broken with a desktop computer, there is just no reason not to use a recent & secured system for which you know that an attacker cannot brute-force it instead of just hoping you're not enough of a target.

TL;DR: No, just use something modern, it'll be as long to implement, and you'll be orders of magnitude more secured

Answer 3

If the purpose of using encryption is simply the amusement of the persons communicating and the communications have no value, then it is not a problem. However, obscurity of the ciphersystem is not a good protection for a communication that has value if it is either surreptitiously read or modified.

Put simply, the reason those ciphersystems are no longer in use is that they possessed a weakness that allows them to be attacked in time shorter than the maximum probable time that the communication will have value. In some cases, the older ciphers may be cryptanalyzed with equipment no more complex than a leaf of graph-paper and a cup of coffee, and may be defeated over lunch.

If privacy, message-integrity and nonrepudiation matter to you, use a product that implements modern, strong, well-studied ciphers (DH, Suite B, PKCS) in verifiable ways (PGP, S/MIME, etc). Use a source of trust that has demonstrated itself trustworthy to vouch for the secrets on which this ciphersystem is based (WOT for PGP, Tier-1 Certifying Authority for S/MIME).

Answer 4

While the answers above are mostly correct, there are exceptions. As mentioned, the One Time Pad is uncrackable, if used correctly (completely randomized text in pads, no pad re-used, pads destroyed after use and kept 100% secure at all times). When someone says that the OTP has been cracked, read the fine print and you will find a physical security problem (pad wasn't destroyed, or was physically recovered). Physical security (distribution, safeguarding of the pad) is definitely the weak link in the scheme. But there are ways to make a OTP pad. Even if the opposition knows the general method, if they don't know the specific inputs to that method (of making the OTP), it could be uncrackable.

Here's a method I came up with-- 1. Two non-related plain text sources are scrambled (TRANSPOSITION) against each other to derive the OTP pad. It would probably be relatively easy to communicate these sources, as they'd be the titles of books, EULAs of programs, speeches, articles, etc. innocuously in a conversation. Remember, these sources can only be used ONCE. 2. Then one by one, ADD each clear text character's numerical value (A=1, B=2, etc.) to the numerical value of each character in the pad, MOD 26, and then convert the number back to a letter. This accomplishes SUBSTITUTION.

You could stop there, and it has been encrypted. But frequency analysis will still probably reveal the language. To guard against this possibility, I add a third step: 3. Count the occurrence of each letter of the alphabet within your encrypted text. Take the largest number, and figure out how many of each other letter you need to inject into the text in order to make it 'Homophonic' (frequency neutral). Inject these extra letters according to a set pattern, which accomplishes OBFUSCATION.

To decrypt, first the homophonic letters are extracted (so the recipient also needs to know this pattern). Then the pad needs to be built, as in step #1. Then, SUBTRACT each character's numerical value from the numerical value of each character in the pad, ignore any '-' sign, and convert back to letter. Voila.

(Note: There are various ways of doing the transposition step (#1). You could use Viginere, Rail Fence, or some other method of transposition. But the method I came up with is to look at your letter in the first text, find where it occurs in the second text, then find what character is in that position back in the first text. That's your letter. There are plenty of other ways to do this, too.)

Transposition by itself is horrible. So is Substitution. But if you use the transposed to perform the substitution, and then make it frequency neutral with homophonic injection, even a quantum computer couldn't crack it. --Gordon