Insecure Crytographic System

Question

Hi :)

I am a newbie in cryptographic system but i have seen many sources tell that

even the good algorithm and good key is not enough,

i have a little confuse why is that?

Answer 1

http://en.wikipedia.org/wiki/Cryptographic_engineering

There are two basic kinds of encryption algorithms in use today:

Private key cryptography, which uses the same key to encrypt and decrypt the message. This type is also known as symmetric key cryptography.

Public key cryptography, which uses a public key to encrypt the message and a private key to decrypt it. The name public key comes from the fact that you can make the encryption key public without compromising the secrecy of the message or the decryption key. Public key systems are also known as asymmetric key cryptography.

http://www.amazon.com/Applied-Cryptography-Protocols-Algorithms-Source/dp/0471117099 . This book is nice one regarding this

Algorithms

http://hell.org.ua/Docs/oreilly/tcpip/puis/ch06_04.htm

U can read this patent is talking about US Patent 6769062 - Method and system of using an insecure crypto-accelerator

http://www.patentstorm.us/patents/6769062/claims.html

Read this http://www.schneier.com/essay-028.html

Answer 2

Possibly not enough because in the game of cryptography there is also the trust part.
Anyway, check out this article: Security Pitfalls in Cryptography

Answer 3

Your question is vague, but I'll add an aspect that is important: The users handling of the key and understanding of the system. Cryptography does in a way move the target from the communication to the sender or recipient.

Also, the algorithms quality is only halfway there - the implementation of the algorithm can introduce unforseen security issues.

Answer 4

The security of a system depends on many factors, only one of which is the cryptosystem of choice.

Modern symmetric (e.g. AES) and asymmetric (e.g. RSA) cryptosystems are very secure (read: practically impossible to break) in themselves, but the way you use the cryptosystem, and user behavior changes everything.

I've always argued that even the most basic cryptographic tasks should be done, or at least supervised, by cryptography experts, and Jeff has recently proved me right.

If you have had no formal education on cryptography, please seek professional advice from an expert.