I recently had a discussion with a friend of mine about cryptography. As we are both no experts, I thought that I could better resolve are dispute here.
My friend said that when he used public key cryptography in the past, he used to keep his public key private too. Only giving it out to people that really needed it (i.e. don't post it on the internet, but giving it out personal to a select group of people). He said that this made it harder for third parties to break the encryption that do not have the public key. I argued that he could have better used a symmetric cipher instead of this scheme, as it is a lot faster and with sufficient key size just as secure. So two questions arise here:
- Does keeping your public key private give you any more security?
- Does this scheme have any advantages over a symmetric scheme?
Also he said that he used to combine different ciphers and run them a random amount of times. Only the other party knows how many times and what cipher combination. He said that it not only makes the encryption stronger by enlarging the effective calculation time, but it also introduces a human factor, that is someone has to think this out and make the decision to try different ciphers different amounts of times. I argued that this is true, but unnecessarily complicated, because choosing a large enough key size for a single cipher will be just fine (can cost thousands of years), even for military security. So:
- Are there any REAL benefits of running different ciphers for random amount of times to try to confuse the attacker? Or is this just unnecessarily complicated?
With military security I mean that, at the current moment, it is impossible to break the encryption, even for governments institutions (like the NSA).
To better illustrate my question: instead of giving out your public key to a select group of people, you give it out to one individual. Furthermore, you can be sure that he knows how to handle a key ring and that he has no benefit from leaking your public key (i.e. he has no benefit from leaking the clear text you messaged to him)