liveBook · Manning

Security through obscurity

As explained in Real-World Cryptography

Security through obscurity is the practice of relying on keeping a system's design or implementation secret as a security measure.

Security through obscurity relies on hiding a system’s design or implementation instead of proving its security through open analysis. Historically, this approach has worked poorly. section 1.3

A stronger cryptographic approach follows a clearer pattern:

  • Keep the secret key confidential. section 1.3
  • Publish the algorithm so cryptanalysts can examine and attack it. section 1.3
  • Build confidence only after extended public scrutiny. section 1.3

AES and public scrutiny

AES emerged from an international NIST competition lasting several years, during which cryptanalysts tried to break competing constructions before one became a widely trusted standard. section 1.3

How Real-World Cryptography covers it

How deep it goes
Defines the failure pattern and contrasts it with open expert analysis, stopping short of detailed attack methods.
Examples
Uses the AES competition, NIST, competing constructions, and public cryptanalysis as concrete examples.
What it assumes
Assumes basic awareness of encryption algorithms, secret keys, and possible ways encryption can be broken.
What you can do after
Evaluate cryptographic designs by asking whether their security survives open expert scrutiny rather than depending on hidden implementation.
How it connects
Connects Kerckhoffs’ principle with cryptographic algorithms, cryptanalysis, secret keys, and AES.
Cover of Real-World Cryptography
liveBookmanning.com
Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.