This question already has an answer here:

The cryptography algorithm I designed is a completely new algorithm and has no similarity to other existing algorithms. But because I am an ordinary person, I have no facilities and the ability to introduce this algorithm except through my website http://twincodesworld.com.

Given the fact that there are no absolutes, this algorithm may also have weaknesses that would affect its validity. Therefore, the website was created solely for testing this algorithm, so that the algorithm will be publicly released if approved by experts in the field. But despite repeated attempts and correspondence with reputable technology websites, nobody was willing to help me. Please guide me and help inform this.


marked as duplicate by SEJPM, CodesInChaos Oct 8 '17 at 17:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from security.stackexchange.com Oct 8 '17 at 16:04

This question came from our site for information security professionals.

  • 2
    $\begingroup$ where is the code? if you want free evaluations, make it easy for us. $\endgroup$ – dandavis Oct 8 '17 at 6:00
  • $\begingroup$ Step 1: release the algorithm for evaluation. Paying people to try and crack an algorithm blind is not a test. $\endgroup$ – schroeder Oct 8 '17 at 15:53

because I am an ordinary person, I have no facilities and the ability to introduce this algorithm

Typically people write a paper and submit it to a journal. If it's any good and indeed "has no similarity to any other existing algorithms", it will definitely cause a stir. Most methods that you and I can come up with, have been thought of and are either used in modern encryption or were discarded for good reasons.

this algorithm may also have weaknesses that would question its validity

That's a good thing to acknowledge! I remember when I invented my first encryption algorithm: I thought it would be unbreakable as long as it remained closed source (it'd be licensed to banks and stuff). I was super naive as a kid :)

Note that my personal story ended with me putting it up on some forum for security experts and someone breaking it despite not having the algorithm.

the website was created solely for testing this algorithm

On your website, I do not see the algorithm. How are we going to test and validate it?

the algorithm will be publicly released if approved by experts in the field

If you really want to do it that way, you can find and pay said experts to vet your idea. I'd advise you to just post it publicly and see if anyone can pick it apart. Only if there are no glaringly obvious flaws, you might want to have some experts look at it. And actually, if it's indeed good and new, experts will probably be attracted by themselves.

despite repeated attempts and correspondence with reputable technology websites

Wait, crypto experts typically do not reside on technology websites. You'll be wanting to contact consultants and show them green stuff that they can use to exchange for bread and cheese at local stores.

nobody was willing to help me.

They might have recognized that you are at the wrong address, or if you weren't, they'll have gotten many requests from rookies that wanted to validate their neophyte algorithms. Many rookies go down this path of (1) self-inventing things that are stupid and (2) not knowing how to publish. Myself included. I'm not saying that you are a rookie, but it's just likely that you are and people will often not find it worth their time to look at.

Crypto is seen as a hard field because it is indeed hard to do properly. It's not something that comes to you while in the shower, but typically requires years of study. By then, you will have seen how others published their work, so you'll know how to publish. Also, others might have seen your name already if you've been active in the field, which also gives you more credibility to start with.

Please guide me and help inform this.

Release the algorithm and ask some hacker friends to take a go at it for fun.

And optionally, write a paper and try to get a journal to publish it. This should get it reviewed by others from the field.

By the way, having a bounty (as it's called; it's not a bonus) is nice. It'll definitely attract people to look at it. Just be prepared to pay out!

It's a little off-topic (your question is "how to introduce to the world", not "is it secure"), but if I may comment on your video and challenge:

Looking at the video, you're not entering any password. From that I assume that the key material is either (1) hard-coded in the program, (2) written into the output file or (3) does not exist (i.e. the algorithm is the key material). In case of option 1, that's bad practice; option 2 means it's just not encryption (it's encoding); and option 3 means you've violated Kerckhoff's principle.

On the other hand, I'm happily surprised to see that your challenge file has good entropy. When turning the ascii decimals into binary, ent gives me 7.93 bits/byte (for 3099 bytes of binary; testing with 3099 bytes of /dev/urandom I get 7.94 bits per byte). It's at least of better quality than what I invented when I was younger :).

  • 1
    $\begingroup$ Great answer! Made me happy, since I was only expecting snarky responses to OP :) $\endgroup$ – thel3l Oct 8 '17 at 5:02
  • 3
    $\begingroup$ @thel3l I've been in the same position in the past (when I was 15 and naive), so I could relate and tried to give him/her a fair answer :) $\endgroup$ – Luc Oct 8 '17 at 10:05
  • 1
    $\begingroup$ we've all tried with varying degrees of success. I remember thinking that our (a friend and I) implementation of the Vigenère cipher was unbreakable haha :D $\endgroup$ – thel3l Oct 8 '17 at 10:14

If you want to be taken seriously by cryptographers you need to speak the language of cryptography. This means you need to write your algorithm description in standard cryptography terminologies. If you don't want to bother learning the language of cryptography, why should other highly skilled, busy people learn your terminologies?

You also need to be familiar with existing attack techniques and issues, you need to fairly evaluate and elaborate how your algorithms attempts to handle various attacks and issues, again with standard terminologies. It's also important to write a sample implementation and publish the source code for it for reviewers. It helps if your encryption system is based on well known mathematics, but if you're not aware of any similar mathematical problems and theories that your cryptosystem is based on, then you should do your own homework first and find the closest mathematical background and/or supply mathematical proofs of your claims.

In other words, you need to be a cryptographer to be taken seriously by cryptographers.

  • 4
    $\begingroup$ Or, more accurately, you need to perform cryptography to be taken seriously by cryptographers. People who perform cryptography are cryptographers. There isn't some sort of secret club or something. $\endgroup$ – schroeder Oct 8 '17 at 15:51