Why You Shouldn't Write Your Own Encryption Algorithm

When you're writing a network server, you may be tempted to create your own encryption algorithm to protect data. In this video I explain why that's a bad idea...

Click the following link for a summary:

[joeblackwood]

Great video.

Let's say that I have a file and I decide to encrypt it by doing some very complex operations on it (on a binary level). Let's say that once done encrypting, I deleted (zero out memory) the program that encrypted the file and held the key in a usb stick or sd card always stored on me. Would someone without access to the keys be able to decrypt that file assuming the encrypting algorithm is complex enough?

From my understanding of the video, no one would be able to because they do not have my key and even if they did I am the only person who knows about the algorithm (thus the only person who can create a decryption algorithm) since I am not doing network stuff, but only encrypting a personal file.

I'm just trying to figure out if unbreakable encryption is possible if I am the only person who knows about the algorithms and keys and that I do not share them with anyone or if encryption can be broken whether you need to share data with others (network or similar scenario) or not.

[bryanarycode]

You are talking about vulnerabilities specific to programming languages. You would never use built functions to randomize sensitive data no matter the language you are using. On top of that you would never use a single layer of alteration. You want multiple layers. As many as you are able to code while achieving the desired output. I would suggest everyone attempt creating their own encryption. I would not suggest using it in production without having it tested against decryption software, or someone who specializes in decryption, but without trying you really can't understand the nuances of creating an encryption algorithm.