0
$\begingroup$

After rigorous testing, it seems that it can possibly be a NIST-level candidate algorithm.

However, explaining or even finding the right people, experts in cryptography to talk about his invention seems to be quite a challenge. It's a time-consuming process to explain and present the material and a hard to believe subject...

We want to share this with the world to receive feedback and conduct a proper peer review. So we thought about maybe publishing a paper in a scientific magazine.

We live in the EU Greece and if someone has any advice on how we should move on it would be highly appreciated.

$\endgroup$
2

1 Answer 1

5
$\begingroup$

Congratulations! You've put together a homebrew cipher, and you think it looks good. What do you do now?

Well, here's the bad news: you will find it extremely challenging to get anyone in the cryptographical community to take your new cipher seriously; homebrew ciphers are a dime-a-dozen, and for an expert, doing a thorough analysis often takes a lot of time, and will be unlikely to show anything positive (almost all the time, there's either a weakness, or the system is so complex that it's too expensive to use) - hence, experts generally find something more productive to do with their time.

You have a couple of options:

  1. Give up; really, what you have is almost certainly not as wonderful as you think it is; you might be better off not wasting your time.

  2. Give people a reason to suspect you might have something. First off; no one respects a cipher that was designed by someone who doesn't know how to do cryptanalysis, and so you'll need to learn it (and prove it by doing public cryptanalysis of other ciphers out there - there are plenty). When you learn that, perhaps you can go ahead and show why the various known cryptanalytic methods won't work. Even then, it'd still be difficult to get people to listen; you might have a shot (and most likely, you'd see the flaws in your current design).

$\endgroup$
13
  • 1
    $\begingroup$ I'd add "3. Show performance benchmarks that demonstrate your cipher is better than existing state-of-the-art on a variety of hardware & input sizes, a la bench.cryp.to". Otherwise there'd be no reason to use it even if it's secure, so analyzing poorly performing ciphers is a waste of time. $\endgroup$ Feb 23, 2022 at 13:05
  • 1
    $\begingroup$ @SAIPeregrinus Actually, your step 3 would be a part of step 2 (show why your cipher might be interesting), and would be far easier than what I had outlined (learn cryptanalysis) - however, it might be a decent way to get rid of poorly performing proposals with comparatively little effort... $\endgroup$
    – poncho
    Feb 23, 2022 at 14:51
  • 1
    $\begingroup$ "Also, after the speed tests in software level, we are almost 1000x faster than AES-GCM/CTR and 52x than ChaCha20"; seems improbable, as you'd be literally faster than the memory bandwidth of the CPU... $\endgroup$
    – poncho
    Feb 23, 2022 at 21:41
  • 1
    $\begingroup$ I've never heard of the library before and I have no idea what sort of performance it gets; it is not particularly interesting if you're comparing yourself with a bad AES implementation. How do you compare to OpenSSL? In any case, you still haven't given any reason for me to expect that it is actually secure $\endgroup$
    – poncho
    Feb 24, 2022 at 3:33
  • 1
    $\begingroup$ The claim of an "arbitrarily long key" is usually an indicator that the designer does not understand encryption. Keylengths (stream ciphers being symmetric key) longer than say 256 bits are utterly meaningless from the point of security. But they feature prominently in what are called "snake oil" designs. $\endgroup$
    – kodlu
    Feb 24, 2022 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.