Schneier on Security

logicnazi • June 1, 2005 4:51 AM

There certainly are places where security through some amount of secuirty may be quite valuable even for cryptographic algorithms. For instance if you are the NSA your in house analytic capabilities probably greatly exceed any contribution you might get from interested outsiders. Furthermore knowledge of the algorithm may greatly aid attacking countries and it is perfectly reasonable that this aid causes more harm than the free eyeballs gained by releasing it.

On a more pragmatic example suppose you are going to make an irreversable commitment to an encryption algorithm, e.g., DVD encryption, and for some reason you can't use a well tested off the shelf solution. Now if your algorithm is only availible in hardware obscurity will likely slow any attacker somewhat and extend the lifetime of the device encryption (some benefit is also had putting it in software). Conversely, releasing the algorithm from the general community is not likely to attract much aid before it is released (would *you* go do some free analysis for the MPAA to help make their encryption better). Since the commitment to the algorithm may be irreversable I hardly see how finding out what the flaw is in the algorithm once it is deployed helps them.