🚀 go-pugleaf

I think we ought to give a serious answer to the question:

"I've developed a new, totally different, really, really good encrytion
 algorithm called NuC (pronounced 'nuke' :-), and I understand that it
 isn't going to be taken seriously until it is subjected to, and survives,
 a challenge attack by the real experts. How do I do this?"

(Which is sort of what the base note was saying; give the guy some credit
for even knowing that sci.crypt exists, and that a challenge attack is
relevent.)

OK, my shot at a serious answer:

You are proposing that you have a cryptographic device(*) that is
both:

1) more intractable that, e.g. DES

2) intractable enough that it can be safely used to protect millions
   or billions of dollars worth of assets

-or-

3) is not as effective, but is of serious interest because it uses
   a unique method.

We will discard alternative (3); the obvious answer is to prepare
a paper describing the innovation, publish it, and either expose youself
to acclaim, ridicule, or, perhaps, pity. 

If your device(*either hardware or software) called NuC is to be
accepted, it must:

4) show that it has a theoretical basis for its security other than
   simple obscurity, and

5) survive challenges by experts who are conversant with the theoretical
   basis.

Now we will back off a little from that: you may want to test its
ability to resist attack when parts of the algorithm are modified,
or attempt to conceal the method for a proprietary advantage.

Understand that this will cause nearly all experts to ignore it:
the probability that it is some method that is (a) known, or (b)
inane or obviously flawed, or (c) equivalent to a known method,
is so close to 100% the difference isn't worth considering unless
there is some indication that this method is different. (Note that
case (c) is by far the most common case.)

So you still want to run a challenge. Fine. You need to:

6) provide copies of the device (the software) to the people
   attempting to meet the challenge.

In the real world when NuC is used, the NuC devices will be all
over the place; reverse engineering one will not be difficult.
More importantly, we are going to run extensive known-plaintext
attacks; they are not difficult to run in the real world applications.
Even given plaintext attacks are fairly easy, and nearly all
ad hoc encryption methods, probably including NuC, will fall fast
under a simple differential analysis attack. (Simple A,B,C sort
of thing, not even using the more recent developments.)

And most importantly, you need to:

7) Provide a serious reward. Something that will make people with
   better things to do spend time at it. Refer to point #2, and
   plan on offering $100,000.

Too big a risk? But I thought you had this wonderful encryption
method, better than anything else. You might want to try a smaller
reward first, and scale it up. Start with $5000.

Best Regards,
Robert

--
Robert Ullmann		Ariel@World.STD.COM	+1 508 879 6994 x226
Quand Maigret poussa la porte du Tabac Fontaine, vers une heure et demie,
le patron du bar, qui venait de se lever, descendait lentement un escalier
en colima çon qui s'amor çait dans l'arri ère-salle. ... Arriv é derri ère le
comptoir, il repousa le gar çon d'un geste n égligent de la main, saisit
une bouteille de vin blanc, un verre, m élangea au vin de l'eau min érale et,
la t ête renvers ée en arri ère, se gargarisa.  -- Simenon