I am wondering if AES-128 and the likes were once broken and if they were broken because people knew they were trying to break AES then why don't we create our own personal algorithm to encrypt the data and let the intruders wonder which algorithm was used?
4
-
1This question already has a good set of answers here security.stackexchange.com/questions/2202/… but basically the answer is that designing encryption algorithms is hard and you are very likely to do it badly. Even experienced well funded people make mistakes with crypto– Rory McCuneAug 22, 2015 at 9:38
-
Let's suppose if I create something as simple as which swaps the bytes in a data file. How can anyone else read it without knowing if a swapping algorithm was used?– user158421Aug 22, 2015 at 9:42
-
3there's a whole field of study dedicated to analysing and defeating unknown encryption algorithms, it's called cryptanalysis en.wikipedia.org/wiki/Cryptanalysis– Rory McCuneAug 22, 2015 at 9:44
-
1@user158421 just because you can't break it yourself doesn't mean someone else smarter than you can't either.– tangrsAug 22, 2015 at 11:57
Add a comment
|
1 Answer
You could create a proprietary encryption algorithm, but to ensure that it is secure you would need to make it public, so it can be properly tested. (bar the secret key obviously).
Security through obfuscation is not recommended. This is the basis of Kerckhoffs's principle.
"The principle goes as follows: A cryptographic system should be secure even if everything about the system, except the key, is public knowledge."
Read more detail here; Kerckhoffs's principle
answered Aug 22, 2015 at 9:43
-
What I don't understand is why go through such complex process if you can simply hide the data through techniques such as swapping, altering, or mixing original data with custom data etc. ? Aug 22, 2015 at 10:12
-
There are two factors at play here, the cryptographic algorithm, which will encrypt the information and obfuscation which is a blurring of the mechanisms used to implement the cryptography. You have to assume that the enemy will discover the mechanisms used to encrypt while still keep the information in the data secure. To do this the cryptography must be tested, to properly test it and for it to be trustworthy you should make it public. If it is for your own personal use then fine, go ahead, but how could you be sure that someone hadn't broken your encryption? Aug 22, 2015 at 10:16
-
Even more basic than to ensure it is secure, in order to use it for communication (unless you are only using it to store your own private data) you are going to have to share the algorithm with your communicants. Either you create one algorithm for each communicant or you basically make it public. Good luck getting all your communicants to install your custom crypto software.– emoryAug 22, 2015 at 17:19