cryptography faq net etiquette archive name cryptography faq part last modified faq for sci crypt part net etiquette this is the second of ten parts of the sci crypt faq the parts are mostly independent but you should read the first part before the rest we don t have the time to send out missing parts by mail so don t ask notes such as kah refer to the reference list in the last part the sections of this faq are available via anonymous ftp to rtfm mit edu as pub usenet news answers cryptography faq part xx the cryptography faq is posted to the newsgroups sci crypt sci answers and news answers every days contents what groups are around what s a faq who am i why am i here do political discussions belong in sci crypt how do i present a new encryption scheme in sci crypt what groups are around what s a faq who am i why am i here read news announce newusers and news answers for a few weeks always make sure to read a newsgroup for some time before you post to it you ll be amazed how often the same question can be asked in the same newsgroup after a month you ll have a much better sense of what the readers want to see do political discussions belong in sci crypt no in fact some newsgroups notably misc legal computing were created exactly so that political questions like should rsa be patented don t get in the way of technical discussions many sci crypt readers also read misc legal computing comp org eff talk comp patents sci math comp compression et al for the benefit of people who don t care about those other topics try to put your postings in the right group questions about microfilm and smuggling and other non cryptographic spy stuff don t belong in sci crypt either how do i present a new encryption scheme in sci crypt i just came up with this neat method of encryption here s some ciphertext fhdsijoyw ogbujhkfsyuire is it strong without a doubt questions like this are the most annoying traffic on sci crypt if you have come up with an encryption scheme providing some ciphertext from it is not adequate nobody has ever been impressed by random gibberish any new algorithm should be secure even if the opponent knows the full algorithm including how any message key is distributed and only the private key is kept secret there are some systematic and unsystematic ways to take reasonably long ciphertexts and decrypt them even without prior knowledge of the algorithm but this is a time consuming and possibly fruitless exercise which most sci crypt readers won t bother with so what do you do if you have a new encryption scheme first of all find out if it s really new look through this faq for references and related methods familiarize yourself with the literature and the introductory textbooks when you can appreciate how your cryptosystem fits into the world at large try to break it yourself you shouldn t waste the time of tens of thousands of readers asking a question which you could have easily answered on your own if you really think your system is secure and you want to get some reassurance from experts you might try posting full details of your system including working code and a solid theoretical explanation to sci crypt keep in mind that the export of cryptography is regulated in some areas if you re lucky an expert might take some interest in what you posted you can encourage this by offering cash rewards for instance noted cryptographer ralph merkle is offering to anyone who can break snefru but there are no guarantees if you don t have enough experience then most likely any experts who look at your system will be able to find a flaw if this happens it s your responsibility to consider the flaw and learn from it rather than just add one more layer of complication and come back for another round a different way to get your cryptosystem reviewed is to have the nsa look at it a full discussion of this procedure is outside the scope of this faq among professionals a common rule of thumb is that if you want to design a cryptosystem you have to have experience as a cryptanalyst
