Perhaps the saying "security through obscurity doesn't work" should be amended to say "security that depends on the secrecy of anything that cannot be easily changed doesn't work". In most cases, cryptographic keys are far more easily changed than cryptographic algorithms. That's why it's bad to rely on the secrecy of an algorithm, but okay to rely on the secrecy of a key. Phil