-3
$\begingroup$

I am using standard encryption AES/CBC.

I wonder if I can invest some time adding my own custom encoding/decoding after the encryption just as an extra security layer.

Does it really add any value in case the public algorithm is broken and the key still not compromised?

Is unknown custom algorithm (encoding/decoding) secure because no one knows about it except me?

Can you please support with samples of attacks that may break my assumption?

Update.

I am aware how weak is Ceaser Ciphering. I am on this argument with a colleague. He is in favor of using AES then applying custom shuffling as extra protection.

My stand is that it does not add anything rather than performance toll. I can't seem to prove that argument, while he bases his on the fact that we are already using AES and that encoding would put extra effort on the attacker.

Thanks for the downvotes, it's a stupid question needs answers with solid proofs.

$\endgroup$
  • 1
    $\begingroup$ Encoding is not encryption: en.wikipedia.org/wiki/Kerckhoffs's_principle . If an adversary can break your public key, how long do you think a custom encoding algorithm will slow them down? $\endgroup$ – bmm6o Oct 19 '17 at 15:45
  • $\begingroup$ Thank you, I know the difference between encoding and encryption. The point is that I am applying some sort of shuffling after the encryption. Does it really worth the effort? $\endgroup$ – Amr ElAdawy Oct 19 '17 at 16:04
  • $\begingroup$ Somewhat related: Combining multiple symmetric encryption algorithms - implications? $\endgroup$ – e-sushi Oct 19 '17 at 19:37
  • 3
    $\begingroup$ This sort of thing bring to mind this analogy: "I'm not sure if this tank armor is quite strong enough; I know, I'll paste on some cardboard; that'll help..." $\endgroup$ – poncho Oct 20 '17 at 0:29
  • $\begingroup$ my encoding scheme is several times faster than Base64, and that is the only reason I use a custom scheme, performance $\endgroup$ – Richie Frame Oct 20 '17 at 2:48
1
$\begingroup$

Absolutely not as it's a violation of Kerckhoffs' principle and relies on security through obscurity which is rather hard to justify. Both have been widely discussed on this site. You have to assume that they know everything except the key.

As a stupid example, imagine that you're 13 years old and have developed a totally fab encryption algorithm that you think is unbreakable. You take every character and replace it with a character 13 places along the alphabet. And you keep it secret. You might feel pleased with yourself. Such a substitution cipher is easy broken at college level. Now say you're older and develop something much more sophisticated. Will it still be unbreakable by GCHQ and NSA? Just because you can't, doesn't mean that they can't.

And numbers work against you. If Amr encoding was indeed good and became popular, more people would want to attack it. This is what's happened with OpenSSL and wireless WEP. There only needs to be one chink in the armour and if many very clever people are looking...

$\endgroup$
  • $\begingroup$ Thanks for the answer, I just want to bear in mind that this linear encoding comes after encryption. $\endgroup$ – Amr ElAdawy Oct 20 '17 at 6:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.