I took a cryptography class back in college, and now that I am working my 1st career one of the things currently on my plate is coming up with an algorithm to encrypt data before it's placed on the server (In this case it's pretty sensitive info). I remember different modes of operation from that class like cipher block chaining and things of the like. I know that some of them are pretty hard to crack, but since they are so commonly known is it even practical to consider using something like that as an encryption method considering the algorithms for encryption and decryption are commonly known (from a security perspective)?
3
-
4$\begingroup$ Kerckhoffs's principle $\endgroup$– CodesInChaosCommented Mar 25, 2015 at 12:34
-
1$\begingroup$ Note that there is a difference between the mode of operation and the block cipher itself. Both are needed for a general encryption algorithm of course and both should adhere to Kerckhoff's principle. If you want to encrypt on the front office side / decrypt on the back office side you may consider asymmetric encryption. Certainly take a look at what's already out there. $\endgroup$– Maarten Bodewes ♦Commented Mar 25, 2015 at 16:08
-
$\begingroup$ Furthermore, there is no need for you to re-blaze well-trodden ground. In general, unless you have specific requirements that they don't solve, you should use GPG for data at rest, TLS for data in motion. If you are typing the letters A-E-S into your code, you're doing it wrong. $\endgroup$– Stephen TousetCommented Mar 25, 2015 at 19:18
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
I know that some of them are pretty hard to crack, but since they are so commonly known is it even practical to consider using something like that as an encryption method considering the algorithms for encryption and decryption are commonly known (from a security perspective)?
In fact, this is exactly what we want.
Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break.
That is why it is crucial that the algorithms be made public. If the only information I keep secret from you is a relatively short key (128-bits isn't much), and you still cannot break the cipher, then one could argue that the cipher is stronger than one where you have to keep a few megabytes (the source code) protected.
