Tell me like I'm 5: How are algorithms secure if people can see them

Question

I have a limited understanding of encryption of data. I know that servers and clients can encrypt and decrypt information through a variety of methods. I also know that security through obscurity is not a good idea and that there are very reliable open-source encryption options.

That said, I've been told (or read somewhere) that the type of encryption used is non-reversible. i.e. you can't decrypt something by knowing the algorithm. This is the bit that I can't grasp. How can an algorithm not be reverse engineerable? Why are open source encryption options considered more secure than proprietary equivalents?

Thanks

Answer 1

A modern cipher algorithm concentrates the required secrecy into the key instead of the algorithm. This is helpful because a key is relatively short, compared to even the most compact binary representation of a simple cipher. This means there is actually less to protect then the algorithm itself. Only the person(s) who know the key can encrypt or decrypt messages.

Physical Locks work the same way. A lock can only be opened or closed with the key. Knowing that there is a lock on the door does not help in getting past it, even if you know what type of lock it is.

People learned a while ago that obscurity and quantifiable security are not the same thing. This is usually referred to as Kerckhoffs's principle.

As for your question about open source/proprietary algorithms:

• Firstly, the open source equivalents aren't just open source, they are industry/government standards, like the Advanced Encryption Standard and Secure Hash Algorithm families

• A proprietary algorithm may not have seen review by any or more importantly enough other cryptographers, for long enough.

• There exists snake oil cryptography, which advertises itself as being supremely secure, but is sometimes outright silly to those who understand well enough.