# How to submit a new method of encryption?

I came up with a truly new method of applying modulo-2-addition encryption function in stream ciphers which is inspired by a mechanism used to prove a mathematical theorem. How can I determine whether my method is cryptographically correct and considerable? If so, how can I officially submit or formally register it in my name? And finally, can I make money thorough this method just by selling it to an encryption company or organization?

EDIT

Hi everyone, thanks for all answers and comments. It seems quite heartening. I know that modulo 2 operation is equivalent to XOR (exclusive OR operation in Boolean Algebra) gate in electronics. As you all know, the overriding issue concerning the security of stream ciphers is how to generate truly random key streams, and actually my newly-inspired method mainly deals with this issue. I mean this method can produce or generate random key streams in an entirely new way for either stream or block ciphers. I finally decided to publish my workings on this topic very soon for gaining cryptographic credits rather than just making money.

• As for the money, I've done some work on standardization, and if there is even a possible patent application then we won't use an algoritithm, let alone if we have to pay for it. It's not that we would not want to spend the money for it, it's more because we don't want to force others to fork over any cash (or go through the trouble of getting a license). – Maarten Bodewes Aug 25 '12 at 16:18
• Modulo-2-addition ? I.e. "xor" ? – Tom Leek Aug 26 '12 at 0:16
• Don't be too hopeful. It's very likely that your method is badly broken. – CodesInChaos Aug 31 '12 at 16:40
• Good question. I'd suggest reading Schneier's Memo to the Amateur Cipher Designer – rath Jan 5 '14 at 22:55
• You really only have one chance for success here ( and of course this applies to everyone else): you will have to prove that your cipher is mathematically unbreakable, which means you must prove that it is a one way function, which means you must solve one of the most difficult open problems in computer science. Good luck! – William Hird Aug 25 '16 at 23:13

Write documentation / a paper:

• An overview

What kind of cipher it is and an outline of how it works.

Why should somebody use it, over existing designs? Possible advantages include:

• A simple and elegant design
• Being faster or cheaper on certain platforms
• Having features or security properties other designs lack
• Specification of the cipher

It should be possible to implement your cipher from the specification, without looking at the reference implementation.

• Security claims

There are many security definitions, which of those apply to your design?

For a block cipher you might aim for a strong pseudo-random-permutation. For a stream cipher you might claim that its output is indistinguishable from truly random data. Make sure to use the standard names and definitions for those properties, not just an informal description.

One important purpose this section has is to show that you're aware of and aiming for strong modern security definitions. Too many beginners argue that their cipher isn't broken because the attacks don't demonstrate full plaintext recovery in a ciphertext only scenario.

• Benchmarks

How fast is your algorithm on different platforms? For symmetric algorithms this is typically given as CPU-cycles per byte (cpb). Make sure to disable Turbo Boost on Intel CPUs and to mention that you did so.

• Design rationale

Why does your algorithm look like it does?

• Your own crypto-analysis, if you did it.

For example you might describe how to break a round-reduced version of your cipher

• Test vectors

Example tuples containing key, plaintext and ciphertext, to help implementers check if their implementation is correct.

• Typeset it properly, using LaTeX. People will see if you did it in Word and that will leave a bad impression.

Implement it:

• A reference implementation which focuses on clarity
• An optimized implementation, which you use to determine the performance of your algorithm

For symmetric algorithms I recommend including a C implementation.

Now the hard part is getting somebody to look at it:

• If there is an upcoming competition, submit it.
• Upload the paper to https://eprint.iacr.org.
• Submit it to a peer reviewed conference or journal.
• Make a name for yourself, for example by attacking other people's ciphers

You won't make any money selling or patenting a cipher. There are too many good and free algorithms available. Even great designs like OCB mode weren't adopted due to being patented.

• "You won't make any money with it" - Not directly, but it is possible that a good crypto algorithm will get you a good job/research position etc – figlesquidge Jan 5 '14 at 11:18

How can I determine whether my method is cryptographically correct?

Well, that depends quite a bit on what your primitive does, and what security properties you claim for it. As for examples of security properties, you might claim it does privacy (someone without the key cannot determine anything about the plaintext) or integrity (if someone without the key modifies the message, with high probability the decryptor will notice it).

In general, determining whether an encryption method is secure is a hard problem. However, if your method takes a keystream (generated from outside your solution) as long as the message, and combines it somehow to form the encrypted message, and your aim is to provide privacy, it turns out there's it may be easy to show: show that for every pair of plaintexts and ciphertexts of the same length, there exists one possible keystream that would convert that plaintext into that ciphertext (or, more generally, exactly $N$ keystreams, for some fixed $N$ independent of the plaintext/ciphertext). If you can show that, then you've shown that if the attacker cannot distinguish the keystream from random, he cannot gain any information from the ciphertext (because, as far as he can tell, all plaintexts are equally possible); hence you have a secure solution (as long as you use a cryptographically secure keystream generator).

How can I determine whether my method is cryptographically significant?

Well, that's actually fairly easy: with extremely high likelihood, it isn't. If it is just a way to combine a plaintext and a key stream, well, you might be able to show it's secure, but we have existing ways to combine plaintexts and keystreams, and those work quite well. If my guess is wrong, and you've got something else, well, you need to show cryptographically correctness first (and if that involves showing some computational problem is hard, that's extremely difficult to show, even if you got it right, which you probably haven't).

Can I make money thorough this method just by selling it to an encryption company or organization?

Another easy question: no. There are lots of encryption algorithms which are both free and have been vetted by respected cryptographer (the types that have broken other ciphers). Why would anyone pay you anything, when they can get better solutions for free?

Modulo 2 addition is a synonym for xor. $0\oplus0=0$, $0\oplus1=1$, $1\oplus0=1$, $1\oplus1=2=0$.

Xor-ing the keystream and the plaintext is a very standard step in stream ciphers. If this is what you mean by mod 2 addition, unfortunately you are not the first to come up with this. If not, I'd agree with @CodesInChaos and publish a paper on it.

• Hi everyone, thanks for all answers and comments. It seems quite heartening. – Lesbegue2012 Aug 31 '12 at 14:32