0
$\begingroup$

I took a cryptography class back in college, and now that I am working my 1st career one of the things currently on my plate is coming up with an algorithm to encrypt data before it's placed on the server (In this case it's pretty sensitive info). I remember different modes of operation from that class like cipher block chaining and things of the like. I know that some of them are pretty hard to crack, but since they are so commonly known is it even practical to consider using something like that as an encryption method considering the algorithms for encryption and decryption are commonly known (from a security perspective)?

$\endgroup$
  • 4
    $\begingroup$ Kerckhoffs's principle $\endgroup$ – CodesInChaos Mar 25 '15 at 12:34
  • 1
    $\begingroup$ Note that there is a difference between the mode of operation and the block cipher itself. Both are needed for a general encryption algorithm of course and both should adhere to Kerckhoff's principle. If you want to encrypt on the front office side / decrypt on the back office side you may consider asymmetric encryption. Certainly take a look at what's already out there. $\endgroup$ – Maarten Bodewes Mar 25 '15 at 16:08
  • $\begingroup$ Furthermore, there is no need for you to re-blaze well-trodden ground. In general, unless you have specific requirements that they don't solve, you should use GPG for data at rest, TLS for data in motion. If you are typing the letters A-E-S into your code, you're doing it wrong. $\endgroup$ – Stephen Touset Mar 25 '15 at 19:18
5
$\begingroup$

I know that some of them are pretty hard to crack, but since they are so commonly known is it even practical to consider using something like that as an encryption method considering the algorithms for encryption and decryption are commonly known (from a security perspective)?

In fact, this is exactly what we want.

Schneier's law

Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break.

That is why it is crucial that the algorithms be made public. If the only information I keep secret from you is a relatively short key (128-bits isn't much), and you still cannot break the cipher, then one could argue that the cipher is stronger than one where you have to keep a few megabytes (the source code) protected.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.