Militaries have some options on choosing Encryption algorithms, schemes, and protocols;
- They can use open community encryption algorithms, schemes, and protocols that are designed and analyzed by many brilliant cryptographers.
- They can ask to 3rd parties to built for them if they have no Cryptographic expert in their army.
- They can create their own Cryptographic Algorithms and Schemes and keep the designs and analyzes to themselves.
They fear from the first option since they don't want to use the open algorithms.
They think that there can be always a back door.
They use the second option if they don't have the talent and even they buy from a another country's companies. Many examples are exist in history.
For the last two option, we can see it like security by obscurity but not exactly. Oscar (the eavesdropper of the signal) has to deal many problems:
- The communication can be online encryption that is the network traffic is always encrypted and there is always a dummy message to encrypt to keep the traffic always on even to prevent signal intelligence.
- The even the Error Correcting Codes (ECC) can give huge disadvantage to Oscar. Which ECC is used is a problem especially if the ECC applied data is an encrypted data.
- Below this online encryption, the officials of the army can encrypt the messages with the usual symmetric and asymmetric encryption schemes. This turn the data into double encryption.
The above list may no be complete, anyway, jump to history;
The history shows us that, obscurity is not the correct way. Remember how the Enigma was stolen and finally broken. Even when the 4th rotor was introduced, only the knowledge of the 4th hole was enough to break again. Ironically, the M-209 much easier to break which was mechanical marvel.
Today, information espionage much easier than the older times. So, in reality, the militaries also plays with the Kerckhoffs's principles. They assumes that even the designs falls into the hands of the enemy rule, too. They only use the secrecy of the design and analyze as a frontal counter measure with the deep question;
- What if our algorithms, schemes, and protocols are not really secure as we think.