• Security by obscurity: all you do is hidden, everything (algorithm, how it works, etc) is kept secret. This approach might work in the first time but there is a main drawback: designers think that what they created is perfect, but it will surely have security flaws.
  
• Kerckhoffs principle (simplified): the cryptographic algorithm must be public except the keys used. This is a strong constraint as the designer assumes that the attacker perfectly knows the algorithm and how it works but even with that information, he's not able to compromise data confidentiality.
  

(07-08-2014, 03:06 PM)Templar.Clown Wrote:

(07-08-2014, 02:52 PM)Ex094 Wrote:

(07-08-2014, 02:42 PM)Templar.Clown Wrote: I wonder how the nsa would do against a algorithm they have never seen before.... I mean like one that is created by a user with the intent to disrupt there snooping.

Best Cryptographer means these guys know hell lots of stuff and it's not just 1 person it's a whole team.

I still think if someone created something unlike the other encryption that is out there I don't think they could crack it so easy. Even as a team.

(07-08-2014, 03:08 PM)lady_godiva Wrote: They will surely try to break it and most likely they will only take very short time to do this. It depends on how strong the design of the algorithm is.

Rather than distinguishing between symmetric and asymmetric encryption, I'd say we should consider the 2 opposites: Security through obscurity and Kerckhoffs principle.

• Security by obscurity: all you do is hidden, everything (algorithm, how it works, etc) is kept secret. This approach might work in the first time but there is a main drawback: designers think that what they created is perfect, but it will surely have security flaws.
  
• Kerckhoffs principle (simplified): the cryptographic algorithm must be public except the keys used. This is a strong constraint as the designer assumes that the attacker perfectly knows the algorithm and how it works but even with that information, he's not able to compromise data confidentiality.
  

Each of the two approached still makes it really hard to develop a robsust algorithm. Try to think of RSA, or an hashing algorithm properties. It's not hard to satisfy them when it comes to designing your solution!

Anyway the main way to attack and encryption algorithm is to use techniques that aim to explit regularities in the cyphertext in order to gain information about the plaintext. If the algorithm isn't strong enough, they are going to succeed.

(07-08-2014, 03:06 PM)Templar.Clown Wrote: I still think if someone created something unlike the other encryption that is out there I don't think they could crack it so easy. Even as a team.

(07-08-2014, 07:22 PM)lady_godiva Wrote: Not so correct, none figured a way to actually crack RSA. Efficient prime factorization algorithm hasn't been found yet. They only way is to bruteforce the key, if you use a long enough key it would take too long. So yes, it is possible to design such algorithm, but as i said it happens very very rarely

(07-08-2014, 07:22 PM)lady_godiva Wrote: Not so correct, none figured a way to actually crack RSA. Efficient prime factorization algorithm hasn't been found yet. They only way is to bruteforce the key, if you use a long enough key it would take too long. So yes, it is possible to design such algorithm, but as i said it happens very very rarely

Quote:RSA received $10 million in a deal that set the NSA formula as the default method for number generation in the BSafe software [...] it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous
year
—
Reuters,
“
Secret contract tied NSA and security
industry pioneer
”

Quote:RSA adopted the algorithm even before NIST approved it. The NSA then cited the early use of Dual Elliptic Curve inside the government to argue successfully for NIST approval
—
Reuters,
“
Secret contract tied NSA and security
industry pioneer
”

(07-09-2014, 10:58 PM)lady_godiva Wrote: As i previously said, setting a long enough key is a good method to prevent organizations and others (not the NSA) from compromising you data confidentiality, it's pretty clear that no matter what key you use, NSA will still be able to decrypt all your stuff

(07-10-2014, 12:06 AM)Insider Wrote:

(07-09-2014, 10:58 PM)lady_godiva Wrote: As i previously said, setting a long enough key is a good method to prevent organizations and others (not the NSA) from compromising you data confidentiality, it's pretty clear that no matter what key you use, NSA will still be able to decrypt all your stuff

Yeah :/ That's kind of sad! Anyway, I found this interesting presentation about this today! You should check it out :Laughing: http://regmedia.co.uk/2014/05/16/0955_peter_gutmann.pdf