Can someone break my weak home-brew encryption?

blog.ram.rachum.com

7 points·cool-RR··6 comments

One single, lonely piece of ciphertext is probably perfectly safe. Home-brew encryption becomes a problem when arbitrary plain-text can be enciphered. Then you get differential analysis, and you risk exposing the algorithm.

This isn't worth anyone's time to play with, and I'm sure you'll end up with a feeling that it's secure.

Deploy it, use it. Then details of the algorithm will leak, multiple cipher-texts will be available, and that's when you'll have problems. Besides, if no one except you uses it, it's probably secure enough. Letting someone else use it means exposing the algorithm. Then you'll have trouble.

I will never use it for anything, if that wasn't obvious. It's just an exercise.

But that's the point. If you use it, the method will leak, and people will get multiple texts, and then there's a chance to break it. The weaknesses will be exposed. With a single, short piece of cipher-text (a) no one will care, and (b) it's probably safe enough.

You're not learning anything by doing this, but you might think you are. That's the problem.

It would be a better excercise if multiple ciphertexts from the same key were posted, as well as some ciphertexts from different keys. That would simulate real world interaction with the output of an encryption scheme.

For more backstory, this was originally posted as a question on Security.SE (which, when looking at it now, has had the encrypted text removed):

http://security.stackexchange.com/questions/32779/how-would-...

kerkhoff principle; encryption should not rely on keeping an algorithm as secret. a key can be changed, an algorithm not if it's widely in use

Reply on news.ycombinator.com