Re: snake oil (Posting ciphers to the list)

[tcmay@netcom.com (Timothy C. May)]

Perry Metzger writes on the matter of posting newly-invented ciphers
to the Cypherpunks list:

> My suggestion is this.
> 
> Its perfectly appropriate to post the cypher to the list PROVIDED you
> take the right attitude, which is to say something like:
> 
> "The following is something I just thought up. I'm not a pro, and I
> worry that this thing has holes. Anyone care to give me hints on what
> they might be?"

Good advice! Some hubris might pique the interest of readers.

> Sci.crypt is likely a better place to post a query about a new cypher,
> of course.

Yes, except that they for the most part hate it when folks post "I
dare you to break my new cipher" messages. Understandably so, for the
reasons Perry gave (smugness, etc.) and also because:

a. usually not enough ciphertext can be posted to allow a reasonable
cryptanalysis

b. the odds of a newbie inventing something really new are slim (yes,
it _may_ happen, but it's not likely)

c. people have better things to do that spend hours or days trying to
break a system which has these problems (and may just be deliberate
garbage).

(Cryptanalysis is economics, as some folks like to say. If a message
is important, or a particular cryptosystem has passed some initial
tests--such as the algorithm being published, the basic mathematics
presented as plausible, etc.--then more effort can be justified. But
not on Joe Cipher's latest effort.)

(this quote is from Nicky M.)

> > Is there a comprehensive list of short "already been done" types of
> > cyphers?  (Whether failed or "still" succesful.)  A good book?

Kahn's "The Codebreakers" for a historical perspective, the various
crypto books referred to here for mathematical background (Denning,
Brassard, Salomaa, Simmons, Patterson, etc.), and "Cryptologia" for
insights into amateur cryptanalysis and cipher-building.

Be aware that most amateurs--and I hardly speak from experience, just
reading of the literature--end up reinventing the old _types_ of
ciphers....the new ones, with s-boxes, or based on hard math problems
(like RSA), typically require a lot of background in math.

Hope this helps, and hope this eases any hard feelings folks may have
when their Super Duper Encrypter is not analyzed by a dozen
Cypherpunks. Or even one.

-Tim May 

-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
Note: I put time and money into writing this posting. I hope you enjoy it.