GSEC · Question #126
To be considered a strong algorithm, an encryption algorithm must be which of the following?
The correct answer is B. Well-known. Kerckhoffs's principle states that a cryptographic algorithm should be secure even if everything about the system, except the key, is public knowledge.
Question
To be considered a strong algorithm, an encryption algorithm must be which of the following?
Options
- ASecret
- BWell-known
- CConfidential
- DProprietary
How the community answered
(48 responses)- A4% (2)
- B73% (35)
- C15% (7)
- D8% (4)
Why each option
Kerckhoffs's principle states that a cryptographic algorithm should be secure even if everything about the system, except the key, is public knowledge.
Keeping an algorithm secret is 'security through obscurity,' which is not considered a strong security property since discovery of the algorithm immediately breaks the system.
Kerckhoffs's principle, a foundational tenet of modern cryptography, requires that an algorithm's security must rest entirely on the secrecy of the key, not on the algorithm itself being hidden. Well-known algorithms like AES and RSA are publicly scrutinized by the global cryptographic community, which strengthens confidence in their security by exposing any weaknesses. Proprietary or secret algorithms cannot be vetted, making undiscovered flaws far more likely.
Confidential is equivalent to secret in this context - relying on algorithm secrecy for security violates Kerckhoffs's principle.
Proprietary algorithms are not publicly audited, meaning vulnerabilities may exist that have never been discovered or disclosed, undermining trust.
Concept tested: Kerckhoffs's principle in cryptographic algorithm strength
Source: https://csrc.nist.gov/glossary/term/kerckhoffs_principle
Topics
Community Discussion
No community discussion yet for this question.