Re: Encryption algorithm used for the IBMi OS passwords.

On 4/4/2016 6:05 PM, Nathan Andelin wrote:

Sure, it's fine if you keep the exact

algorithm you choose to use a secret as long as that algorithm has been
tested and vetted in the open by experts.

How does your algorithm remain secret if you allow it to be vetted "in the
open"?

Say there are a dozen crypto algorithms which are publicly vetted and
considered strong enough for my application. I choose one of them. I
don't publicise to the world /which/ one I've chosen. The algorithm
itself is widely known; which one I am using is not.

Kerckhoff's principle argues that the secret lies in the
key, not in the algorithm. The top minds in the
cryptography field agree that published, vetted
algorithms are superior to obscure, unpublished
algorithms. At least, I don't know of any who disagree.

Again you're talking about people who have a vested
financial interest in pushing "standards".

Well, yes there is noise and FUD by self-appointed 'experts' who are in
fact vendors of this snake oil or that. But the existence of snake oil
salesmen in the world doesn't mean that all vendors are purveyors of such.

Anyway, there are plenty of top crypto minds who are university
researchers who don't profit from the results of their work. They also
agree that provably strong is better than untested and therefore
strength literally unknown even to a first approximation.

Based on conversations with my dad, I believe that
the protocols, practices, and algorithms used by
the U.S. military are not vetted "in the open".

I think I understand where I've let you down. I don't intend the
expression 'in the open' to mean that randos on Reddit can comment on
it. I mean that the algorithm is passed around the top crypto minds on
the planet.