2 ms·

You are free to stand by your principles. I'm arguing that "security through obscurity" is not equivalent with the "Kerckhoffs's principle" but with adding mor

You are free to stand by your principles. I'm arguing that "security through obscurity" is not equivalent with the "Kerckhoffs's principle" but with adding more obfuscation layers (on which steganography may be one of them) on top of default schemes. People who know better don't advertise their internal network topology. Nor do they show off with their encryption schemes (they might use known schemes but they won't tell you they do it).

mindslight 11y ago
How those additional layers are defined is quite important as to their effectiveness - do they hold up to scrutiny, or are they merely good enough to trick their designer? Lumping effective crypto along with feel-good ad-hoc schemes into one big category of "obfuscation" is a disservice to analysis. I'll repeat - Kerckhoffs's principle is more about analysis than design. If you insist on eschewing it, what you're actually doing is making it so the "key" of your system includes the design of the system itself. And while it intuitively seems "more key" should make the system more secure, the net effect is the opposite as that poorly-specified "key" merely functions as a difficult-to-analyze crutch. Gödel basically guarantees that anybody can make a cryptosystem so secure they themselves cannot break it. Don't be that guy.