This is a very basic and practical question. Since I started reading cryptography recently, these things keep bugging me.
What are the things that an adversary is usually aware of before planning an attack? Let's say an adversary plans an attack on a server of a big company.
- Does he know what encryption scheme/model is being used by the company to protect its data stored in the server?
I think usually companies use very standard and popular schemes that are known already to the cryptographic community since using a totally unknown scheme might have a huge data leakage which the company was not able to discover.
- Let's say adversary knows about the model. So what about the specific functions that are used in them. For eg. Pseudorandom generators used in stream ciphers(obviously, the key is not known), or S-box in case of DES etc. Are these things known to the adversary already?
I think these things are usually fixed while implementing the model. And even if these things are known, for example S-box in DES is known, it still won't change the security of the scheme. But even if the company tried to hide the above functions, can it actually increase the security of the data?
I think this is mainly the information that separates the user and the adversary. But can you tell what are the other things that are hidden in practical implementations?
My assumptions are based on the quote that one should only use encryption schemes that are trusted by the cryptography community. Else there is a high probability that there can be an unknown leakage that an adversary can exploit.