I recently had a discussion with a friend of mine about cryptography. As we are
ID: 649023 • Letter: I
Question
I recently had a discussion with a friend of mine about cryptography. As we are both no experts, I thought that I could better resolve are dispute here :-).
My friend said that when he used public key cryptography in the past, he used to keep his public key private too. Only giving it out to people that really needed it (i.e. don't post it on the internet, but giving it out personal to a select group of people). He said that this made it harder for third parties to break the encryption that do not have the public key. I argued that he could have better used a symmetric cipher instead of this scheme, as it is a lot faster and with sufficient key size just as secure. So two questions arise here:
Gives keeping your public key private any more security?
Does this scheme have any advantages over a symmetric scheme?
Also he said that he used to combine different ciphers and run them a random amount of times. Only the other party knows how many times and what cipher combination. He said that it not only makes the encryption stronger by enlarging the effective calculation time, but it also introduces a human factor, that is someone has to think this out and make the decision to try different ciphers different amounts of times. I argued that this is true, but unnecessarily complicated, because choosing a large enough key size for a single cipher will be just fine (can cost thousands of years), even for military security. So:
Are there any REAL benefits of running different ciphers for random amount of times to try to confuse the attacker? Or is this just unnecessarily complicated?
Thanks in advance.
Explanation / Answer
Keeping the public key private:
As for cascading ciphers, it just makes processing slower, and more complex, both activities being ultimately detrimental to security (way more than the off-chance that one of the algorithms is actually weak, which does not happen often as long as none of them is a homemade cryptosystems -- these, of course, are almost always laughably vulnerable).
And "military security" is not stronger than normal security; it is just usually much more expensive.