1
$\begingroup$

We have a customer asking about what methods we use to secure our system. Specifically they want to know what encryption algorithm we use for how we manage passwords. My philosophy is the harder it is for the bad people the better, so my mind set is keep as much secret as possible no matter how miniscule or how easily inferred the details can be. So I'm very hesitant to say anything.

We of course don't want to lose any business over this, so I guess my question is, is it ok to say we use "********" encryption algorithm? In other words, if you told someone what algorithm you use how much of a security breach could that be considered? Thanks in advance!

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ It does not matter if you keep that thing secret, read about Kerckhoffs's principle, it is possible that asking those questions be part of social engineering but if the person is already your customer and giving them answers, could make them satisfied, give it to them, be sure just by knowing what algorithm you use can not make harm to your system but not telling them may cause losing them and losing them make you out of business. $\endgroup$
    – R1w
    Nov 12, 2020 at 21:09
  • $\begingroup$ If a vendor is using an encryption algorithm for passwords, I most definitely want to know about that as a customer, so that I can find a different vendor as soon as possible! $\endgroup$
    – Jörg W Mittag
    Nov 14, 2020 at 16:11

1 Answer 1

Reset to default
2
$\begingroup$

No, it's not bad to tell this info. In fact, it's suspicious when someone doesn't reveal the design of the system. Kerckhoffs's principle states that a system must remain secure so long as an attacker knows everything except a designated secret "key".

For symmetric encryption, "key" means secret keys. For asymmetric cryptography (signatures and key exchange) that means private keys. For password storage, that means the passwords themselves (and possibly a "pepper" value, if used).

I'd personally assume that anyone who isn't familiar with this is hiding a backdoor in their system. If the cryptography isn't auditable, it's safer to assume it's insecure and use an auditable (open-source or at least source-available) implementation whenever possible.

Improve this answer
$\endgroup$
3
  • 3
    $\begingroup$ @Vandel212: If a vendor does not reveal the crypto they use, this is not a product to be lightly tossed aside; it should be hurled with great force... $\endgroup$
    – poncho
    Nov 12, 2020 at 21:04
  • $\begingroup$ Thank you for the replies $\endgroup$
    – Vandel212
    Nov 12, 2020 at 21:15
  • 1
    $\begingroup$ I totally agree with @poncho , that sort of secrecy is not reasonable and it is not working anymore. $\endgroup$
    – R1w
    Nov 12, 2020 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.