1

I'm developing a cryptographic toolkit and plan to employ custom algorithms for hashing, password stretching, etc. Is there a way I can get them analysed? Yes, I can post it on my website and on sites like reddit as a challenge, but that is the only way?

Please note that this is different from Why shouldn't we roll our own? as this question requires much more specific answers, with links (if any).

Improve this question
4
  • 5
    Frankly, if you don't know the answer to this, then your designs are more likely than not to be trivially breakable. I recommend reading Bruce Schneier's Memo to the Amateur Cipher Designer. A solid presence on Cryptography could be a start right here on Stack Exchange, but is by no means a golden ticket.
    – user
    Commented Oct 29, 2016 at 11:19
  • Voting to close as "product recommendation" not because this is seeking recommendations for exactly a product but because what is being sought is essentially service recommendations, which IMO are close enough to qualify and where answers are liable to quickly become outdated in much the same way as are the case for product recommendations.
    – user
    Commented Oct 29, 2016 at 12:01
  • 2
    If you are confident enough that your algorithms are at least comparable to existing ones (which are heavily studied) you might actually invest (lots of) money to get some acknowledged experts to do a solid analysis. Otherwise probably nobody would feel motivated to invest their own time to do the analysis for an outsider.
    – Steffen Ullrich
    Commented Oct 29, 2016 at 12:08
  • 3
    Offer a challenge. Buy $100k worth of bitcoin. Encrypt the private key for the bitcoin address with your custom algorithm. Post that online - first one to break it wins the bitcoin
    – paj28
    Commented Oct 29, 2016 at 12:56

1 Answer 1

Reset to default
3

There is no easy way to achieve this.

You first have to read enough literature to understand why current algorithms are designed the way they are, and how earlier algorithms have been broken.

Next you have to write a research paper documenting how your algorithm has been secured against all known attacks in existing literature and what your algorithm can do better.

Finally you submit this paper to a serious cryptographic journal and get it accepted. (Beware that if you did not fully understand what you were doing at the earlier steps you are going to get stuck at this step.)

Once your algorithm has been accepted in a journal you wait to see what response you get afterwards. If your algorithm gets attention of the cryptographic community for a few years and does not get broken, then it may be safe start using it.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .