7
$\begingroup$

Several companies offer customized cryptographic algorithms, for example Crypto AG (www.crypto.ch/en/company):

The individually created customer algorithms are unknown to anyone else and are not used by anyone else. A cryptographic attack is not possible, even from an identical unit.

Only the customers know the algorithms:

Autonomous profiling of algorithms: you are the only one who knows the algorithm. Not even Crypto AG has access to it. Moreover, you can use a second additional algorithm when collaborating with other organisations.

These algorithms are hardware-based:

Hardware-based encryption is the foundation for maximum cryptographic diversity – for speed reasons on the one hand and for its immunity to tampering on the other (no readout of data). This approach also ensures that the encryption processes remain cryptographically separated from the network. No common operating system is needed (viral resistance).

Thales offers something similar and calls it Programmable Cryptography (www.thales-esecurity.com/solutions/by-technology-focus/programmable-cryptography)

A company called Mils offers customized algorithms as well (www.mils.com/en/technology/customized-algorithms/)

How does this work? How can they offer a cryptographic algorithm that can be customized by non-specialist customers without support and not run the risk of creating an insecure algorithm? (Ignoring the assumption that this might be the goal)

Note that Crypto AG states that the algorithms runs on hardware. Depending on what they mean by hardware (I understand it as a non-programmable logic circuit with fixed gate connectivity), this severely narrows the available algorithms.

|improve this question
$\endgroup$
  • 3
    $\begingroup$ "Ignoring the assumption that this might be the goal" In the case of Crypto AG, there's strong suspicion that it is. $\endgroup$ – fkraiem Aug 2 '15 at 21:40
  • $\begingroup$ Most HSM's provide such capability. Usually they are embedded processors inside a tamper proof housing. Systems on a board really, although the SoB acronym is already taken. There still seems to be a market demand for custom algorithms. These kind of HSM's simply fill demand. I don't think the providers themselves are that keen on custom algorithms, but as long as you pay and take the blame... Personally I'm more interested in running custom protocols / applications on them; a hardware token that performs crypto for anyone after a single PIN isn't that useful. $\endgroup$ – Maarten Bodewes♦ Aug 2 '15 at 21:56
8
$\begingroup$

Your doubts are absolutely valid. Disguising the algorithm is not a valid argument for security. It also contradicts to Kerckhoffs Law.

It (the algorithm) should not require secrecy, and it should not be a problem if it falls into enemy hands;

Designing cryptographic algorithms (ciphers, hashfunctions, ...) is a long and complicated process. In academia such algorithms are proposed and are analyzed afterwards by other researchers for a long time trying to break them. For AES, it took about two years from publishing to standardization.

If you take a look at linear or differential cryptanalysis, you will notice that innocent looking S-boxes for example can be highly biased reducing the cipher's security drastically. Same applies to other parts of the cipher.

This contradicts highly to the promised security. I would not trust these algorithms at all, nor a machine designing them.

For the hardware part. They could use some sort of FPGA-based HW. This would allow the company to implement the different algorithms on the same boards easily. Speed is a valid point. However, I doubt that their generated algorithms are side-channel proof, which means one could get information about the algorithm itself or the payload that gets en-/decrypted by measuring power, timing or EM for example. If so, the point of "unkown algorithm" would be broken.

TL;DR

  • Hiding the algorithm is not a good idea.
  • Refrain from inventing your own crypto.
  • Do not trust companies that break both :P

Hope this helps

|improve this answer
$\endgroup$
  • 2
    $\begingroup$ If you ever have trouble convincing management of this, draw an analogy. When you have your child in the backseat of a car, would you trust some small company that produces some safety features that have never been seen before on a car, and will never be seen again, or would you buy a Volvo? $\endgroup$ – Cort Ammon Aug 3 '15 at 3:53
  • $\begingroup$ That's kind of the answer that I suspected. The question is motivated more by academic interest, I was wondering if there would be some kind of (very large) family of block ciphers with a security guarantee not to be worse than a well studied cipher so that one could pick one at random for each customer. I definitely won't trust any of these companies, honestly I am surprised they find customers. $\endgroup$ – guest Aug 3 '15 at 4:47
1
$\begingroup$

As the other answer correctly stated, this is likely a bad idea and they are essentially selling only a perception of high security. People who don't have a cryptographic background may be mislead.

How does this work? How can they offer a cryptographic algorithm that can be customized by non-specialist customers without support and not run the risk of creating an insecure algorithm?

This could be done securely in the case of algorithms that have enough constants whose value does not matter. E.g. SHA-256 is most likely either secure or insecure regardless of the IV (since the "IV" changes with multi-block messages). You could allow the customer to "customize the algorithm" by choosing the IV (or other constant). Essentially that just amounts to an additional key, stored in the hardware.

I have no idea if that's what they are doing, but it seems feasible and not necessarily insecure, if they choose the right algorithms. It would not be more secure than simply storing a key in the device (since that's what it amounts to), but may be more "marketable" to non-expert customers.

|improve this answer
$\endgroup$
  • $\begingroup$ Even changing constants in the cipher (constants in a keyschedule for example) can have a massive impact on the cipher's security. Changing stuff like IVs should be standard and not worth advertising. Additionally, they talk explicitly about the algorithm itself, which as already stated, sounds very dangerous to me. $\endgroup$ – Exac Aug 3 '15 at 9:16
  • $\begingroup$ @Exac, yes, that is why I said they would need to choose the right algorithms for it to be secure. Again, I don't know if that's what they are actually doing, and it's likely not a good idea anyway. $\endgroup$ – otus Aug 3 '15 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.