We have a customer asking about what methods we use to secure our system. Specifically they want to know what encryption algorithm we use for how we manage passwords. My philosophy is the harder it is for the bad people the better, so my mind set is keep as much secret as possible no matter how miniscule or how easily inferred the details can be. So I'm very hesitant to say anything.

We of course don't want to lose any business over this, so I guess my question is, is it ok to say we use "********" encryption algorithm? In other words, if you told someone what algorithm you use how much of a security breach could that be considered? Thanks in advance!

  • 1
    $\begingroup$ It does not matter if you keep that thing secret, read about Kerckhoffs's principle, it is possible that asking those questions be part of social engineering but if the person is already your customer and giving them answers, could make them satisfied, give it to them, be sure just by knowing what algorithm you use can not make harm to your system but not telling them may cause losing them and losing them make you out of business. $\endgroup$ – R1w Nov 12 '20 at 21:09
  • $\begingroup$ If a vendor is using an encryption algorithm for passwords, I most definitely want to know about that as a customer, so that I can find a different vendor as soon as possible! $\endgroup$ – Jörg W Mittag Nov 14 '20 at 16:11

No, it's not bad to tell this info. In fact, it's suspicious when someone doesn't reveal the design of the system. Kerckhoffs's principle states that a system must remain secure so long as an attacker knows everything except a designated secret "key".

For symmetric encryption, "key" means secret keys. For asymmetric cryptography (signatures and key exchange) that means private keys. For password storage, that means the passwords themselves (and possibly a "pepper" value, if used).

I'd personally assume that anyone who isn't familiar with this is hiding a backdoor in their system. If the cryptography isn't auditable, it's safer to assume it's insecure and use an auditable (open-source or at least source-available) implementation whenever possible.

  • 3
    $\begingroup$ @Vandel212: If a vendor does not reveal the crypto they use, this is not a product to be lightly tossed aside; it should be hurled with great force... $\endgroup$ – poncho Nov 12 '20 at 21:04
  • $\begingroup$ Thank you for the replies $\endgroup$ – Vandel212 Nov 12 '20 at 21:15
  • 1
    $\begingroup$ I totally agree with @poncho , that sort of secrecy is not reasonable and it is not working anymore. $\endgroup$ – R1w Nov 12 '20 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.