<p>I probably shouldn't answer this, and wouldn't if it had taken any length of time. However, for what it's worth the first cipher is not secure, unless the plaintext is relatively short and you choose new keys randomly with each use. This is because you map each letter to one of a fixed set of 4 byte strings independent of it's position, and the set for each letter is unique. Thus the cipher is simply a <a href="http://en.wikipedia.org/wiki/Substitution_cipher#Homophonic_substitution">substitution cipher with homophones</a>, and there are known ways to break these given sufficiently long cipher text.</p>

<p>Now, potentially your 'short key' could be enormous since the number of ways to partition all 256 strings into 4 sets of 64 strings is extremely large, and the longer this key the more ciphertext would be necessary to break the code, but this is only a polynomial increase with key length. </p>

CC BY-SA 3.0
2012-05-24T19:28:04.880Z
2012-05-24T19:46:56.417Z
2012-05-24T19:46:56.417Z
Joe Fitzsimons
<p>Over the years, two novel encryption techniques have come to mind and been implemented as programming libraries that could be integrated into applications. However, how to analyze their security and vulnerability characteristics has never been very clear, and their usage has been limited to mainly experimental tests. Are there tools available for automated examination of such parameters one may be interested in understanding for an encryption library? Are there bodies of people who are interested in being introduced to new encryption concepts for the purpose of executing their own personal analysis on such a process? I'm not sure where to look.</p>

<p>The first encryption algorithm is a mono-alphabetic simple substitution cipher. It requires two keys to operate and is designed to frustrate frequency analysis. The longer of the keys forms a table by which plain-text has a normal substitution cipher applied. Each encoded byte is then split into four values of two bits each. The second, shorter key is then used to allow a random selection from four groups of sixty-four unique bytes each. Each two bit value from the encoded byte is used to select which group of sixty-four bytes to use. Encoding has two disadvantages: the output is four times larger, and repeated data encoding may allow some frequency analysis.</p>

<p>The second encryption algorithm is a stream cipher like the first but internally operates on blocks of data. It utilizes two keys to operate: the first is a two-dimensional array that describes how to construct a (virtual) multidimensional grid, and the second is an initialization vector for the encoding/decoding engine. It attempts to overcome frequency analysis by encoding bytes with a window of preceding bytes (initialized from the second key). A byte with its preceding window of bytes form a multidimensional index into the aforementioned grid. Unfortunately, encoding duplicate blocks of data longer than the window size starts yielding equivalent data.</p>

CC BY-SA 3.0
2012-05-23T18:23:02.243Z
Perhaps you should summarize the two encryption techniques in the question in order to get a more targeted answer.
Marzio De Biasi
CC BY-SA 3.0
2012-05-23T19:22:38.020Z
You could try asking crypto.se.
Joshua Herman
CC BY-SA 3.0
2012-05-23T20:45:56.387Z
Welcome to cstheory, a Q&A site for *research-level* questions in *theoretical computer science* (TCS). Your question does not appear to be a research-level question in TCS. Please see the [FAQ] for more information on what is meant by this and suggestions for sites that might welcome your question. Finally, if your question is closed for being out of scope, and you believe you can edit the question to make it a research-level question, please feel free to do so. Closing is not permanent and questions can be reopened, check the [FAQ] for more information.
Kaveh
CC BY-SA 3.0
2012-05-24T14:55:45.000Z
Where should I *research* the *theoretical* security of an encryption algorithm? It seems that http://crypto.stackexchange.com/ is about applied cryptography, something entirely different.
Noctis Skytower
CC BY-SA 3.0
2012-05-24T15:00:30.797Z
I'm not a serious practitioner of cryptology, but my understanding that the best way to analyze the security of an encryption system is to try to break it yourself. Play the adversary and try to break it.

Other than that, if you are interested in the "theoretical" security, you'll need to just look at the complexity of a known method for breaking the system. For example, in RSA, the assumption that integer factorization is hard (i.e., in NP but not P) is essential to the notion that RSA is secure.
Philip White
CC BY-SA 3.0
2012-05-24T15:00:30.797Z
Is there some well-known mathematical problem that your cryptosystem is equivalent to? If not, it may be difficult to ascertain exactly how secure it is without simply trying to attack it.
Philip White
CC BY-SA 3.0
2012-05-24T15:11:11.187Z
I see some vulnerabilities if certain precautions are not taken. An example with the first algorithm: if the same data is encrypted with the same keys twice, a map of what the bytes mean could be constructed, and frequency analysis could be conducted. For the second algorithm: encrypting data that has a duplicated block of data longer than the initialization vector leads to some duplication in the cipher-text as well. Presumably, compressing the data before encrypting it would make attacks more difficult. Besides noting needed precautions, I am not sure how to go about trying to break systems.
Noctis Skytower
CC BY-SA 3.0
2012-05-24T15:17:00.417Z
It sounds like the crypto site they mentioned is the right place to go; they would know how to try to break your system.  CStheory is about subjects like computability and complexity theory; unless you have a specific search problem that is linked to your system, there's little to say from a complexity/computability theory standpoint.
Philip White
CC BY-SA 3.0
2012-05-24T15:22:07.410Z
This is a good place to ask a *research-level* (check the FAQ Kaveh gave you a link to) question about theoretical crypto. From a cryptanalysis point of view, there are more sophisticated attacks that you have not even considered. From a theoretical point of view, your schemes are unlikely to satisfy any common security definition. I recommend you get an introductory book to modern theoretical cryptography, for example Jon Katz's book http://www.cs.umd.edu/~jkatz/imc.html. Or check Goldwasser and Bellare's lecture notes, available for free http://cseweb.ucsd.edu/~mihir/papers/gb.pdf
Sasho Nikolov
CC BY-SA 3.0
2012-05-24T15:23:30.073Z
Beginner-level questions in computer science can be asked at [cs.se]
Sasho Nikolov
CC BY-SA 3.0
2012-05-24T17:28:03.497Z
I had read the following but found the definition to be unhelpful (one must be able to differentiate between the two): "Questions are considered to be 'research-level' roughly when they can be discussed between two professors or between two graduate students working on Ph.D.'s, but not usually between a professor and a typical undergraduate student." Thanks for the input!
Noctis Skytower
CC BY-SA 3.0
2012-05-24T18:16:27.163Z
You have two questions in your post, neither is suitable for cstheory: "are their tools available for automated examination of such parameters one may interested in understanding for an encryption library?" "Are their bodies of people who are interested in being introduced to new encryption concepts for the purpose of executing their own personal analysis on such a process?" The first is off-topic here, it is about available software. The second one is also clearly off-topic. If you want to introduce your ideas to others, then write a paper and submit it to a crypto conference/journal.
Kaveh
CC BY-SA 3.0
2012-05-24T18:16:58.957Z
If you cannot analyze the ideas and are looking for other people to do that for you then this is unlikely to be a suitable question for cstheory.
Kaveh
CC BY-SA 3.0
2012-05-24T22:07:24.207Z
[Reposted on Computer Science](http://cs.stackexchange.com/questions/2053/after-implementing-a-novel-encryption-algorithm-how-would-one-go-about-analyzin)
Gilles 'SO- stop being evil'
<cr.crypto-security>
After implementing a novel encryption algorithm, how would one go about analyzing its security or get help from others in doing so?
Noctis Skytower
# After implementing a novel encryption algorithm, how would one go about analyzing its security or get help from others in doing so?

(Asked by: username_0 on 2012-05-23)

Over the years, two novel encryption techniques have come to mind and been implemented as programming libraries that could be integrated into applications. However, how to analyze their security and vulnerability characteristics has never been very clear, and their usage has been limited to mainly experimental tests. Are there tools available for automated examination of such parameters one may be interested in understanding for an encryption library? Are there bodies of people who are interested in being introduced to new encryption concepts for the purpose of executing their own personal analysis on such a process? I'm not sure where to look.

The first encryption algorithm is a mono-alphabetic simple substitution cipher. It requires two keys to operate and is designed to frustrate frequency analysis. The longer of the keys forms a table by which plain-text has a normal substitution cipher applied. Each encoded byte is then split into four values of two bits each. The second, shorter key is then used to allow a random selection from four groups of sixty-four unique bytes each. Each two bit value from the encoded byte is used to select which group of sixty-four bytes to use. Encoding has two disadvantages: the output is four times larger, and repeated data encoding may allow some frequency analysis.

The second encryption algorithm is a stream cipher like the first but internally operates on blocks of data. It utilizes two keys to operate: the first is a two-dimensional array that describes how to construct a (virtual) multidimensional grid, and the second is an initialization vector for the encoding/decoding engine. It attempts to overcome frequency analysis by encoding bytes with a window of preceding bytes (initialized from the second key). A byte with its preceding window of bytes form a multidimensional index into the aforementioned grid. Unfortunately, encoding duplicate blocks of data longer than the window size starts yielding equivalent data.

**Tags:** cr.crypto-security
> **Comments:**
> **username_1**: Perhaps you should summarize the two encryption techniques in the question in order to get a more targeted answer.  
> **username_2**: You could try asking crypto.se.  
> **username_3**: Welcome to cstheory, a Q&A site for *research-level* questions in *theoretical computer science* (TCS). Your question does not appear to be a research-level question in TCS. Please see the [FAQ] for more information on what is meant by this and suggestions for sites that might welcome your question. Finally, if your question is closed for being out of scope, and you believe you can edit the question to make it a research-level question, please feel free to do so. Closing is not permanent and questions can be reopened, check the [FAQ] for more information.  
> **username_0**: Where should I *research* the *theoretical* security of an encryption algorithm? It seems that http://crypto.stackexchange.com/ is about applied cryptography, something entirely different.  
> **username_4**: I'm not a serious practitioner of cryptology, but my understanding that the best way to analyze the security of an encryption system is to try to break it yourself. Play the adversary and try to break it.  Other than that, if you are interested in the "theoretical" security, you'll need to just look at the complexity of a known method for breaking the system. For example, in RSA, the assumption that integer factorization is hard (i.e., in NP but not P) is essential to the notion that RSA is secure.  
> **username_4**: Is there some well-known mathematical problem that your cryptosystem is equivalent to? If not, it may be difficult to ascertain exactly how secure it is without simply trying to attack it.  
> **username_0**: I see some vulnerabilities if certain precautions are not taken. An example with the first algorithm: if the same data is encrypted with the same keys twice, a map of what the bytes mean could be constructed, and frequency analysis could be conducted. For the second algorithm: encrypting data that has a duplicated block of data longer than the initialization vector leads to some duplication in the cipher-text as well. Presumably, compressing the data before encrypting it would make attacks more difficult. Besides noting needed precautions, I am not sure how to go about trying to break systems.  
> **username_4**: It sounds like the crypto site they mentioned is the right place to go; they would know how to try to break your system.  CStheory is about subjects like computability and complexity theory; unless you have a specific search problem that is linked to your system, there's little to say from a complexity/computability theory standpoint.  
> **username_5**: This is a good place to ask a *research-level* (check the FAQ Kaveh gave you a link to) question about theoretical crypto. From a cryptanalysis point of view, there are more sophisticated attacks that you have not even considered. From a theoretical point of view, your schemes are unlikely to satisfy any common security definition. I recommend you get an introductory book to modern theoretical cryptography, for example Jon Katz's book http://www.cs.umd.edu/~jkatz/imc.html. Or check Goldwasser and Bellare's lecture notes, available for free http://cseweb.ucsd.edu/~mihir/papers/gb.pdf  
> **username_5**: Beginner-level questions in computer science can be asked at [cs.se]  
> **username_0**: I had read the following but found the definition to be unhelpful (one must be able to differentiate between the two): "Questions are considered to be 'research-level' roughly when they can be discussed between two professors or between two graduate students working on Ph.D.'s, but not usually between a professor and a typical undergraduate student." Thanks for the input!  
> **username_3**: You have two questions in your post, neither is suitable for cstheory: "are their tools available for automated examination of such parameters one may interested in understanding for an encryption library?" "Are their bodies of people who are interested in being introduced to new encryption concepts for the purpose of executing their own personal analysis on such a process?" The first is off-topic here, it is about available software. The second one is also clearly off-topic. If you want to introduce your ideas to others, then write a paper and submit it to a crypto conference/journal.  
> **username_3**: If you cannot analyze the ideas and are looking for other people to do that for you then this is unlikely to be a suitable question for cstheory.  
> **username_6**: [Reposted on Computer Science](http://cs.stackexchange.com/questions/2053/after-implementing-a-novel-encryption-algorithm-how-would-one-go-about-analyzin)  

---

## 1 answers

### Answer by username_7 on 2012-05-24. Score: 6

I probably shouldn't answer this, and wouldn't if it had taken any length of time. However, for what it's worth the first cipher is not secure, unless the plaintext is relatively short and you choose new keys randomly with each use. This is because you map each letter to one of a fixed set of 4 byte strings independent of it's position, and the set for each letter is unique. Thus the cipher is simply a [substitution cipher with homophones](http://en.wikipedia.org/wiki/Substitution_cipher#Homophonic_substitution), and there are known ways to break these given sufficiently long cipher text.

Now, potentially your 'short key' could be enormous since the number of ways to partition all 256 strings into 4 sets of 64 strings is extremely large, and the longer this key the more ciphertext would be necessary to break the code, but this is only a polynomial increase with key length.


---

