cryptographysymmetric-key

Break Symmetric-Key Algo When Secret Key Is Known?


Suppose I have a super simple symmetric-key algorithm, and by super simple I mean it's a straight-up extension of the Caesar Cipher.

If I were to provide ciphertext AND the secret key that was used to encrypt it, what would be the expected probability of someone decrypting it?

I understand the math behind the calculations when the key is secret, but what about if the key is known? Should a typical computer be expected to break it within a reasonable timeframe?

I looked at different symmetric-key breaking techniques but I don't believe any of them will be able to break this algorithm even if the secret key is known. Hence my confusion and the question.


Solution

  • Modern cryptography is based on Kerckhoffs's principle, where we assume that "the enemy knows the system". That means we assume the algorithm and ciphertext are known, and only the secret key is unknown.

    If you give the secret key to the enemy, they know everything. They can just run the decrypt function and get the plaintext.

    And while it's unclear in your question, I think you meant to ask "what if we hide the algorithm?" So instead of making the secret key unknown, what if the algorithm was unknown?

    This poses two problems. First, it's really hard to make a secure encryption algorithm, and you can't collaborate on a secret algorithm, so whatever you have is probably insecure by itself. Maybe it can be broken with frequency analysis without ever looking at the secret key, for example.

    And second, the recipient of the message must also know the algorithm. So you must securely transfer the algorithm from the sender to the recipient. If you have that capability, why are you not using it to send your message in the first place?

    Regarding how difficulty it is to guess an algorithm, that totally depends on how much you "extended" it, and how many ciphertext/secret keys/plaintexts the attacker has access to. This is now a case of Reverse Engineering, not cryptography.

    Can you pile up enough transformations to make reverse engineering infeasible? Yes. Will that add security to your system? Kinda. This specific technique is called Security through obscurity, and is frowned upon due to its high costs and complexity for low security gains.