On 11/06/2023 7:47 am, Principal Kerckhoff wrote:
> The sci.crypt open secret is an exercise in security through obscurity.

No, it's an exercise in demonstrating the weakness of security
through obscurity.

> By keeping the algorithm and source code secret the schemers are
> engaging in security through obscurity.

The source code has been published. To gain access to it you need
only crack the very light encryption in which it's wrapped.
Enough people have done this independently to prove that it can
certainly be done.

> Then by complaining about revelations of the secrets of the algorithm
> they prove a scheme of security through obscurity.

Telling people the algorithm is like telling them the answer to 1
Across. It stops people from achieving the satisfaction of
working it out for themselves.

>
> The schemers have a beef with revelations of the algorithm when the beef
> should be against the practice of security via obscurity.

By the same argument, newspapers should print crosswords with the
answers already inked in. Perish the thought that someone might
enjoy solving a challenge!

--
Richard Heathfield
Email: rjh at cpax dot org dot uk
"Usenet is a strange place" - dmr 29 July 1999
Sig line 4 vacant - apply within