Score:0

A friend created a great Stream Cipher. How should he move forward to maybe be compensated for his work?

cn flag

After rigorous testing, it seems that it can possibly be a NIST-level candidate algorithm.

However, explaining or even finding the right people, experts in cryptography to talk about his invention seems to be quite a challenge. It's a time-consuming process to explain and present the material and a hard to believe subject...

We want to share this with the world to receive feedback and conduct a proper peer review. So we thought about maybe publishing a paper in a scientific magazine.

We live in the EU Greece and if someone has any advice on how we should move on it would be highly appreciated.

poncho avatar
my flag
Does this answer your question? [How to submit a new method of encryption?](https://crypto.stackexchange.com/questions/3634/how-to-submit-a-new-method-of-encryption)
Tunnel_Vision avatar
cn flag
That is very helpful. Thank you very much!
Score:5
my flag

Congratulations! You've put together a homebrew cipher, and you think it looks good. What do you do now?

Well, here's the bad news: you will find it extremely challenging to get anyone in the cryptographical community to take your new cipher seriously; homebrew ciphers are a dime-a-dozen, and for an expert, doing a thorough analysis often takes a lot of time, and will be unlikely to show anything positive (almost all the time, there's either a weakness, or the system is so complex that it's too expensive to use) - hence, experts generally find something more productive to do with their time.

You have a couple of options:

  1. Give up; really, what you have is almost certainly not as wonderful as you think it is; you might be better off not wasting your time.

  2. Give people a reason to suspect you might have something. First off; no one respects a cipher that was designed by someone who doesn't know how to do cryptanalysis, and so you'll need to learn it (and prove it by doing public cryptanalysis of other ciphers out there - there are plenty). When you learn that, perhaps you can go ahead and show why the various known cryptanalytic methods won't work. Even then, it'd still be difficult to get people to listen; you might have a shot (and most likely, you'd see the flaws in your current design).

SAI Peregrinus avatar
si flag
I'd add "3. Show performance benchmarks that demonstrate your cipher is better than existing state-of-the-art on a variety of hardware & input sizes, a la bench.cryp.to". Otherwise there'd be no reason to use it even if it's secure, so analyzing poorly performing ciphers is a waste of time.
poncho avatar
my flag
@SAIPeregrinus Actually, your step 3 would be a part of step 2 (show why your cipher might be interesting), and would be far easier than what I had outlined (learn cryptanalysis) - however, it might be a decent way to get rid of poorly performing proposals with comparatively little effort...
Tunnel_Vision avatar
cn flag
Hello! Thank you for your feedback. I really appreciate your time and answers.
Tunnel_Vision avatar
cn flag
You have many good points and for this reason, I would like to share a few things regarding the algorithm that we believe offers a competitive advantage. The system has some key features like ALK speed(Arbitrarily long key), key-reusing, integrity verification code at byte level. Also, after the speed tests in software level, we are almost 1000x faster than AES-GCM/CTR and 52x than ChaCha20. Lastly, the system has resistance to all the following attacks: Bit flipping, Chiphertext only, Known-plaintext, Key correlation, Differential, Linear. A paper presenting everything in detail coming soon
poncho avatar
my flag
"Also, after the speed tests in software level, we are almost 1000x faster than AES-GCM/CTR and 52x than ChaCha20"; seems improbable, as you'd be literally faster than the memory bandwidth of the CPU...
Tunnel_Vision avatar
cn flag
Hey! Thank you so much for the comment. Sorry, let me be a bit more specific. When encrypting a file with a size of 1GB, our system is almost 1000x faster than AES. For a 100MB file, our system is 107x faster than AES and 34x than ChaCha20. Meaning that we are faster relative to the file size of the encrypted file.
Tunnel_Vision avatar
cn flag
Something else that you may find important to know. We measured the performance on an Intel core i7-8750H clocked at a 2.20 GHz-based computer. We run the tests using two files. One with random characters and the other with only 0s. We compared our implementation with the AES (cbc and ctr versions) of the AES implemented using this library : https://www.chilkatsoft.com/refdoc/vcCkCrypt2Ref.html Specifically , we used the function encryptStringENC (more details and example here https://www.example-code.com/cpp/crypt2_aes_ctr.asp).
Tunnel_Vision avatar
cn flag
@poncho Hey! I would highly appreciate your input on my last two comments.
poncho avatar
my flag
I've never heard of the library before and I have no idea what sort of performance it gets; it is not particularly interesting if you're comparing yourself with a bad AES implementation. How do you compare to OpenSSL? In any case, you still haven't given any reason for me to expect that it is actually secure
kodlu avatar
sa flag
The claim of an "arbitrarily long key" is usually an indicator that the designer does not understand encryption. Keylengths (stream ciphers being symmetric key) longer than say 256 bits are utterly meaningless from the point of security. But they feature prominently in what are called "snake oil" designs.
Tunnel_Vision avatar
cn flag
Thank you very much for your input. It really means a lot. You are absolutely right about today’s meaningless need from a security standpoint. However, please consider the concerns around the upcoming Quantum Computer Era. We still dont know the computing power that will have 10-20 years from now. This encryption design aims to offer value & security for many decades ahead. Lastly, unlike other cryptographic systems in our case due to the unique architecture when we increase the key length, the encryption speed increases proportionally.
SAI Peregrinus avatar
si flag
256 bits is enough for quantum computers the size of entire planets to be unable to brute-force a key for millions of years. Long key lengths are a sign that the designer doesn't understand high-school algebra and some basic physics (all that's needed to show that).
Tunnel_Vision avatar
cn flag
That is correct, I totally agree with this. The key in our system is 256 bits. What I meant is that Key Expansion is arbitrary and correlated with speed. Meaning, the system starts with a 256-bit key, which, if we expand it, then we increase the internal state, thus increasing the speed.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.