[lady_godiva]

They will surely try to break it and most likely they will only take very short time to do this. It depends on how strong the design of the algorithm is.

Rather than distinguishing between symmetric and asymmetric encryption, I'd say we should consider the 2 opposites: Security through obscurity and Kerckhoffs principle.

• Security by obscurity: all you do is hidden, everything (algorithm, how it works, etc) is kept secret. This approach might work in the first time but there is a main drawback: designers think that what they created is perfect, but it will surely have security flaws.
  
• Kerckhoffs principle (simplified): the cryptographic algorithm must be public except the keys used. This is a strong constraint as the designer assumes that the attacker perfectly knows the algorithm and how it works but even with that information, he's not able to compromise data confidentiality.
  

Each of the two approached still makes it really hard to develop a robsust algorithm. Try to think of RSA, or an hashing algorithm properties. It's not hard to satisfy them when it comes to designing your solution!

Anyway the main way to attack and encryption algorithm is to use techniques that aim to explit regularities in the cyphertext in order to gain information about the plaintext. If the algorithm isn't strong enough, they are going to succeed.

[lady_godiva]

I wonder how the nsa would do against a algorithm they have never seen before.... I mean like one that is created by a user with the intent to disrupt there snooping.

Best Cryptographer means these guys know hell lots of stuff and it's not just 1 person it's a whole team.

I still think if someone created something unlike the other encryption that is out there I don't think they could crack it so easy. Even as a team.

Basically i am telling you that you are right!

But despite the diffculty in designing such algorithm, you have to consider that NSA got resources, time and skilled people. Of course it's possible to create one, all i'm trying to say is that it's not so easy.

RSA was developed a long ago and only after almost 40 years EEC was designed, but we had to wait 40 years!

Despite that if NSA didn't have a backdoor in RSA algorithm, it would be enough to use long enough keys

[Insider]

They will surely try to break it and most likely they will only take very short time to do this. It depends on how strong the design of the algorithm is.

Rather than distinguishing between symmetric and asymmetric encryption, I'd say we should consider the 2 opposites: Security through obscurity and Kerckhoffs principle.

• Security by obscurity: all you do is hidden, everything (algorithm, how it works, etc) is kept secret. This approach might work in the first time but there is a main drawback: designers think that what they created is perfect, but it will surely have security flaws.
  
• Kerckhoffs principle (simplified): the cryptographic algorithm must be public except the keys used. This is a strong constraint as the designer assumes that the attacker perfectly knows the algorithm and how it works but even with that information, he's not able to compromise data confidentiality.
  

Each of the two approached still makes it really hard to develop a robsust algorithm. Try to think of RSA, or an hashing algorithm properties. It's not hard to satisfy them when it comes to designing your solution!

Anyway the main way to attack and encryption algorithm is to use techniques that aim to explit regularities in the cyphertext in order to gain information about the plaintext. If the algorithm isn't strong enough, they are going to succeed.

I agree, but don't forget to implement strong operational security. That's probably one of the most important aspects of the art of not getting caught!

Opsec for hackers:


Nice opsec blogs:
* http://grugq.github.com
* http://grugq.tumblr.com
* https://b3rn3d.herokuapp.com/

Underground communication: http://dee.su/uploads/baal.html

[Isaac]

I still think if someone created something unlike the other encryption that is out there I don't think they could crack it so easy. Even as a team.

That kind of stuff only happens in movies, It would take an extreamly intellegent person with a ton of time and resources to pull of something like this.

[lady_godiva]

Not so correct, none figured a way to actually crack RSA. Efficient prime factorization algorithm hasn't been found yet. They only way is to bruteforce the key, if you use a long enough key it would take too long. So yes, it is possible to design such algorithm, but as i said it happens very very rarely

[Ex094]

Not so correct, none figured a way to actually crack RSA. Efficient prime factorization algorithm hasn't been found yet. They only way is to bruteforce the key, if you use a long enough key it would take too long. So yes, it is possible to design such algorithm, but as i said it happens very very rarely

Exactly! well said

[Insider]

Not so correct, none figured a way to actually crack RSA. Efficient prime factorization algorithm hasn't been found yet. They only way is to bruteforce the key, if you use a long enough key it would take too long. So yes, it is possible to design such algorithm, but as i said it happens very very rarely

Though NSA did make them set the number generator to their own formula.

RSA received $10 million in a deal that set the NSA formula as the default method for number generation in the BSafe software [...] it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous
year
—
Reuters,
“
Secret contract tied NSA and security
industry pioneer
”

RSA adopted the algorithm even before NIST approved it. The NSA then cited the early use of Dual Elliptic Curve inside the government to argue successfully for NIST approval
—
Reuters,
“
Secret contract tied NSA and security
industry pioneer
”

[lady_godiva]

As i previously said, setting a long enough key is a good method to prevent organizations and others (not the NSA) from compromising you data confidentiality, it's pretty clear that no matter what key you use, NSA will still be able to decrypt all your stuff

[Insider]

As i previously said, setting a long enough key is a good method to prevent organizations and others (not the NSA) from compromising you data confidentiality, it's pretty clear that no matter what key you use, NSA will still be able to decrypt all your stuff

Yeah :/ That's kind of sad! Anyway, I found this interesting presentation about this today! You should check it out :Laughing: http://regmedia.co.uk/2014/05/16/0955_peter_gutmann.pdf

[lady_godiva]

As i previously said, setting a long enough key is a good method to prevent organizations and others (not the NSA) from compromising you data confidentiality, it's pretty clear that no matter what key you use, NSA will still be able to decrypt all your stuff

Yeah :/ That's kind of sad! Anyway, I found this interesting presentation about this today! You should check it out :Laughing: http://regmedia.co.uk/2014/05/16/0955_peter_gutmann.pdf

Thanks for sharing this, i found it very interesting.