Is it bad to tell someone what encryption algorithm your system uses? We have a customer asking about what methods we use to secure our system. Specifically they want to know what encryption algorithm we use for how we manage passwords. My philosophy is the harder it is for the bad people the better, so my mind set is keep as much secret as possible no matter how miniscule or how easily inferred the details can be. So I'm very hesitant to say anything.
We of course don't want to lose any business over this, so I guess my question is, is it ok to say we use &quot;********&quot; encryption algorithm? In other words, if you told someone what algorithm you use how much of a security breach could that be considered? Thanks in advance!
No, it's not bad to tell this info. In fact, it's suspicious when someone doesn't reveal the design of the system. Kerckhoffs's principle states that a system must remain secure so long as an attacker knows everything except a designated secret &quot;key&quot;.
For symmetric encryption, &quot;key&quot; means secret keys. For asymmetric cryptography (signatures and key exchange) that means private keys. For password storage, that means the passwords themselves (and possibly a &quot;pepper&quot; value, if used).
I'd personally assume that anyone who isn't familiar with this is hiding a backdoor in their system. If the cryptography isn't auditable, it's safer to assume it's insecure and use an auditable (open-source or at least source-available) implementation whenever possible.