🚀 go-pugleaf

Me again, with another question that may get me cooked me medium to well
done ;-)

Somebody (<n0e07t@ofa123.fidonet.org> Erik Lindano) suggested posting some
type of challeng & then got fried.  The main points of the comments seem to
be:

1) A crypto system without keys is useless (I agree, but did his original
post say this?  This (no key == no value) seems blantantly obvious, and
somebody else [forget who] questioned this point also... Response, Erik?)

2) Nobody will look at a challenge unless the encryption method is fully
disclosed first.  Now here's where I have a dilema...

Lets say I invent some new encryption scheme (call it Rcrypt - for Really
crypt) and it is Honest to God unbreakable (put away those flamethrowers,
already!  Some people seem to think that only someone buried in the art for
10+ years can make a breakthrough.  NOT TRUE!  Many breakthroughs in many
areas of science are made by the "newcomers".  This is because they don't
know what is and isn't supposed to work, so in addition to repeating
mistakes, they also see things in new ways - but I digress...)

Anyways, I obviously want to make some $$$$$$$$$$$$$ (OK, maybe only $$$$$)
off of it.  However, nobody will believe me (w/ the openness to new ideas
on this group, that would be a shock! :->).  So I think, I'll post a
challenge.  Let the "experts" try to break it!  But the "experts" say, give
us the whole algorithm first.  Here's the catch...

-To make $$$$ off of it, I should get it patented, but

-To convice myself to spend the $5,000 or $10,000 to get a GOOD lawyer to
 patent it, I want to run the challenge, but

-To run the challenge, people want me to publish the encryption method (& I
 understand the reasoning for this - so the "experts" don't waste time on
 something that's been discovered before, or something that's worthless once
 you know how it works), but

-If I publish the method, I've put a 2 year limit on how long I can wait to
 spend all that $$$$ for a US patent, and I can't get most non-US patents,
 so

-Either nobody will try the challenge, or I'll blow lots of $$$$ on
 patenting a sytstem that only I have tested (IMHO, always a bad idea.
 Never trust the person who made something to be the one to test it - they
 tend to be too close to the problem, and often miss something obvious).
 Catch-22.  Yuck.


I do have an idea for a solution.  How's this sound:

1) Run a challenge with a large amount of known plaintext and ciphertext
(like 50K to 100K), a nice reward ($500?), but do not publish the
encryption method.  Let this test run 3 months.  The idea here is to see if
Rcrypt is very EASILY broken.  The expectation would be the "experts" would
throw some of the simpler/standard (automated?) attacks at it.  They would
spend a relatively small of time on it, like a few hours (qv. "Hey Bob,
lets try cracking this ya-hoo's encryption method.  Shouldn't take long.
Worth $500...")  Also offer the working object code to anybody in the US
that wants it (provided publishing object code != publishing the source
code/method in a legal sense - the lawyer gets some $$$ here).

2) If Rcrypt passes 1), go ahead and patent it.

3) Post the encryption scheme, and re-run the challenge.  Also, make the
actual source code available via US mail.  

ps.  IMHO (for the "non-experts") - DON'T EVER post an encryption scheme's
source code to the internet, even with just a USA distribution.  If
somebody has a domain set up wrong, or they're news daemon is broken or
"fixed", and the source code gets out of the country, you just violated US
munitions export laws.  Also, the internet likes to view obstructions to
postings, like political boundaries, as hardware failures, and it's pretty
good and finding any way around them (IEEE Spectrum did an interesting
article on news where they mentioned this.)  It's my understanding that
some of the more effective (nasty?) arms of our goverment frown on such
things, & I don't think they'll buy "But it was a US distribution.  I
didn't MEAN to break the law... :-(

Thanks for any comments (even nasty ones)...

Dane Butzer

-------------------------------------------------------------------------------
 HappY HappY JOY JOY !!!  |  Long disclaimer does not follow.  Press n to skip
          - Ren & Stimpy  |  anyways...          butzerd@ee.eng.ohio-state.edu
-------------------------------------------------------------------------------