How to submit a new method of encryption?

Question

I came up with a truly new method of applying modulo-2-addition encryption function in stream ciphers which is inspired by a mechanism used to prove a mathematical theorem. How can I determine whether my method is cryptographically correct and considerable? If so, how can I officially submit or formally register it in my name? And finally, can I make money thorough this method just by selling it to an encryption company or organization?

EDIT

Hi everyone, thanks for all answers and comments. It seems quite heartening. I know that modulo 2 operation is equivalent to XOR (exclusive OR operation in Boolean Algebra) gate in electronics. As you all know, the overriding issue concerning the security of stream ciphers is how to generate truly random key streams, and actually my newly-inspired method mainly deals with this issue. I mean this method can produce or generate random key streams in an entirely new way for either stream or block ciphers. I finally decided to publish my workings on this topic very soon for gaining cryptographic credits rather than just making money.

Answer 1

Write documentation / a paper:

• An overview

  What kind of cipher it is and an outline of how it works.

• Advantages of your algorithm

  Why should somebody use it, over existing designs? Possible advantages include:

  • A simple and elegant design
  • Being faster or cheaper on certain platforms
  • Having features or security properties other designs lack

• Specification of the cipher

  It should be possible to implement your cipher from the specification, without looking at the reference implementation.

• Security claims

  There are many security definitions, which of those apply to your design?

  For a block cipher you might aim for a strong pseudo-random-permutation. For a stream cipher you might claim that its output is indistinguishable from truly random data. Make sure to use the standard names and definitions for those properties, not just an informal description.

  One important purpose this section has is to show that you're aware of and aiming for strong modern security definitions. Too many beginners argue that their cipher isn't broken because the attacks don't demonstrate full plaintext recovery in a ciphertext only scenario.

• Benchmarks

  How fast is your algorithm on different platforms? For symmetric algorithms this is typically given as CPU-cycles per byte (cpb). Make sure to disable Turbo Boost on Intel CPUs and to mention that you did so.

• Design rationale

  Why does your algorithm look like it does?

• Your own crypto-analysis, if you did it.

  For example you might describe how to break a round-reduced version of your cipher

• Test vectors

  Example tuples containing key, plaintext and ciphertext, to help implementers check if their implementation is correct.

• Typeset it properly, using LaTeX. People will see if you did it in Word and that will leave a bad impression.

Implement it:

• A reference implementation which focuses on clarity
• An optimized implementation, which you use to determine the performance of your algorithm

For symmetric algorithms I recommend including a C implementation.

---

Now the hard part is getting somebody to look at it:

• If there is an upcoming competition, submit it.
• Upload the paper to https://eprint.iacr.org.
• Submit it to a peer reviewed conference or journal.
• Make a name for yourself, for example by attacking other people's ciphers

You won't make any money selling or patenting a cipher. There are too many good and free algorithms available. Even great designs like OCB mode weren't adopted due to being patented.

Answer 2

How can I determine whether my method is cryptographically correct?

Well, that depends quite a bit on what your primitive does, and what security properties you claim for it. As for examples of security properties, you might claim it does privacy (someone without the key cannot determine anything about the plaintext) or integrity (if someone without the key modifies the message, with high probability the decryptor will notice it).

In general, determining whether an encryption method is secure is a hard problem. However, if your method takes a keystream (generated from outside your solution) as long as the message, and combines it somehow to form the encrypted message, and your aim is to provide privacy, it turns out there's it may be easy to show: show that for every pair of plaintexts and ciphertexts of the same length, there exists one possible keystream that would convert that plaintext into that ciphertext (or, more generally, exactly $N$ keystreams, for some fixed $N$ independent of the plaintext/ciphertext). If you can show that, then you've shown that if the attacker cannot distinguish the keystream from random, he cannot gain any information from the ciphertext (because, as far as he can tell, all plaintexts are equally possible); hence you have a secure solution (as long as you use a cryptographically secure keystream generator).

How can I determine whether my method is cryptographically significant?

Well, that's actually fairly easy: with extremely high likelihood, it isn't. If it is just a way to combine a plaintext and a key stream, well, you might be able to show it's secure, but we have existing ways to combine plaintexts and keystreams, and those work quite well. If my guess is wrong, and you've got something else, well, you need to show cryptographically correctness first (and if that involves showing some computational problem is hard, that's extremely difficult to show, even if you got it right, which you probably haven't).

Can I make money thorough this method just by selling it to an encryption company or organization?

Another easy question: no. There are lots of encryption algorithms which are both free and have been vetted by respected cryptographer (the types that have broken other ciphers). Why would anyone pay you anything, when they can get better solutions for free?

Answer 3

Modulo 2 addition is a synonym for xor. $0\oplus0=0$, $0\oplus1=1$, $1\oplus0=1$, $1\oplus1=2=0$.

Xor-ing the keystream and the plaintext is a very standard step in stream ciphers. If this is what you mean by mod 2 addition, unfortunately you are not the first to come up with this. If not, I'd agree with @CodesInChaos and publish a paper on it.