🚀 go-pugleaf

In article <1992Apr9.204018.12320@mnemosyne.cs.du.edu> bfairlan@isis.cs.du.edu (Brian Fairlane) writes:
>Interested people/companies: Send me textfiles, and I will encrypt
>                             them and send them back (uu-encoded).
>                             Of course I will use the same key for all
>                             your files, so you have One chance of making
>                             it (don't ask me how though).

You've just (re)invented security through obscurity.  The goal is to find
algorithms that are secure, even if the algorithm is publicly known, and
the "enemy" has access to other data encrypted with the same key (in both
encrypted & non-encrypted form), etc.  If knowing the algorithm makes it
possible to defeat the encryption, your system is of little practical use,
since anyone with a reverse-assembler and patience can figure out how the
encryption is done.

If you post your complete algorithm, I'm sure you'll get plenty of
feedback/suggestions.

-- Paul Kocher

________kocherp@leland.stanford.edu_________kocherp@jacobs.cs.orst.edu________
I am an undergrad at Stanford seeking summer work or contract jobs programming
(IBM PC), doing technical writing, or assisting with research. Send e-mail for
resume if interested!  - Paul Kocher/Box 13554/Stanford CA 94309, 415/497-6438

in Message-ID: <1992Apr9.204018.12320@mnemosyne.cs.du.edu> from
bfairlan@isis.cs.du.edu (Brian Fairlane):

> Assume I had a fast, simple and "secure" encryption algorithm, can I
> somewhere, somehow "try this out"? I.e. send an encrypted file
> to some pattern research/cryptology place, and ask them to decrypt it,
> back to whatever it was before (plain textfiles) encrypting it.

That's not a good test.  A better test is described below.

> I, who created it, can't in no way figure out how it could be done, but
> I want some independant, professional people to tell if it is.

This takes time.  The differential cryptanalytic attack on FEAL-8 was
not published for a couple of years.  This is the minimum amount of
time you ought to wait between publishing details of an algorithm and
using it.

> Interested people/companies: Send me textfiles, and I will encrypt
>                              them and send them back (uu-encoded).
>                              Of course I will use the same key for all
>                              your files, so you have One chance of making
>                              it (don't ask me how though).

No, that's not a valid test.  What you must do is:

	1. Publish the exact details of your algorithm.
	2. Get someone to send you some text, which you encipher.
	   (this text can be very large.)
	3. Send the enciphered text back to the tester.
	   The tester tries to find the key.
	4. Repeat steps 2 and 3 until the tester is satisfied.

If you do not publish the details of your algorithm, you're just
promoting Security Through Obscurity.  And if you can't allow multiple
adaptive attacks, your encryption algorithm isn't up to the job.

The "best" way to "try out" an encryption algorithm is to submit a
paper describing it to one of the Crypto conferences (Crypto,
Eurocrypt, Asiacrypt.)  If you're lucky :-), one of the attendees
might be able to break your algorithm there and then (this has
happened.)  Alternatively try Cryptologia or the Journal of
Cryptology.  Be warned, such journals tend to have a very long lead
time.

> Sceptics; No, it's not a (key) == (length_of_file) "algorithm".
> It uses "normal" keys in special ways.

Good luck.
Andrew. (a skeptic :-)