GSEC · Question #78
Which of the following best describes the level of risk associated with using proprietary crypto algorithms.?
The correct answer is B. Proprietary algorithms have not been subjected to public scrutiny, so they have been checked less. Proprietary cryptographic algorithms are riskier because they bypass the broad public peer review and cryptanalysis that gives confidence in standardized public algorithms.
Question
Which of the following best describes the level of risk associated with using proprietary crypto algorithms.?
Options
- AProprietary cryptographic algorithms are required by law to use shorter key lengths in the United
- BProprietary algorithms have not been subjected to public scrutiny, so they have been checked less
- CProprietary algorithms are less likely be vulnerable than algorithms that have been publicly
- DProprietary algorithms are not known to generally be any more or less vulnerable than publicly
How the community answered
(39 responses)- A5% (2)
- B72% (28)
- C18% (7)
- D5% (2)
Why each option
Proprietary cryptographic algorithms are riskier because they bypass the broad public peer review and cryptanalysis that gives confidence in standardized public algorithms.
No U.S. or international law mandates that proprietary cryptographic algorithms use shorter key lengths - this is a false premise with no legal basis.
Proprietary algorithms are designed and tested in private, meaning they have not been subjected to the extensive public scrutiny, cryptanalysis, and peer review that public algorithms such as AES or RSA have undergone from the global security research community. This absence of independent review means unknown vulnerabilities or design flaws may exist and go undetected. The principle behind open cryptographic standards - sometimes called Kerckhoffs's principle - holds that security should come from key secrecy, not algorithm obscurity.
This is the opposite of the accepted view - proprietary algorithms are generally considered more vulnerable than public ones precisely because they lack independent verification and broad cryptanalysis.
The cryptographic and security community does not view proprietary and public algorithms as equivalent in risk - public algorithms with peer review are broadly considered more trustworthy.
Concept tested: Risks of proprietary versus publicly vetted cryptographic algorithms
Source: https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines
Topics
Community Discussion
No community discussion yet for this question.