I have been working at an internship this past summer, and have applied a relatively standard technique (formal analysis of a security protocol) to a new (company internal) protocol. The company are pushing me to try and get the analysis published in an academic journal. The results do not highlight anything of particular note (a few caveats and gotchas but nothing with substantial security implications), but simply provide a rigorous mathematical underpinning for their security assertions.

Is this something publishable? I feel it isn't because the only new bit is the protocol which was simply given to me (and is being published in its own right). If not how do I make the results of the analysis available? Obviously the analysis needs to be made public and peer review is vital (because otherwise nobody would trust the security claims). Do I just put it on the company website and hope people in the know stumble across it? Can I email appropriate people and hope they look at it?

  • 1
    I make my living as a mathematician off applying standard ideas to new problems and I do not see much difference. Just make sure that the paper is interesting and has some twist and that you make it clear that you do not propose any new methodology there.
    – fedja
    Sep 3, 2013 at 13:42

3 Answers 3


You might consider sitting down with the people arguing for publication to try and understand why they consider it to be (potentially) publishable. It's possible, for example, that this new protocol addresses some issues not addressed by existing protocols; or addresses them more efficiently, or robustly, or is otherwise better in some way. In other words, it's possible that the protocol by itself (without your security analysis) is not publishable, and your security analysis by itself (without the novelties of the new protocol) is not publishable, but the two taken together may possibly be publishable.

  • The protocol is publishable on its own merit. The analysis merely demonstrates that they have carefully considered its security and thus they can call it secure in marketing bumf.
    – jhoyla
    Sep 2, 2013 at 13:03
  • In that case you could consider writing a technical report of your security analysis and leaving it to your manager to decide whether to submit your report for external publication.
    – debray
    Sep 2, 2013 at 13:12
  • I suggested this to him but he wants me to publish it myself.
    – jhoyla
    Sep 2, 2013 at 13:47
  • I think the question to ask would be: Does this paper make a contribution? --- i.e., Would someone working in this field benefit (learn something useful) from reading what you've done? If the answer is "yes" then it's potentially publishable; if not then it isn't. On a related note, the publication venue you choose should be one where the potential beneficiaries hang out.
    – debray
    Sep 2, 2013 at 22:26

I would not recommend just putting it on the company's website or emailing it to anyone - if you sent it for publication, you would get:

  • peer review and feedback of your algorithms, assumptions and conclusions.

  • potentially, validation for your application of the underlying rigorous mathematics.

Potentially, you could publish as an internal company white-paper.

Unless this is proprietary information, I would suggest that if you have had the work verified internally, perhaps ask them to be a co-author.

Being published would bring it to the attention of those in the same field, potentially allowing more valuable feedback and allowing further development and research to be performed on the work you have completed.

Finally, why not get published recognition for your work.

  • I'm not applying new techniques or producing new results so does the research count as novel?
    – jhoyla
    Sep 2, 2013 at 13:04
  • Then what's actually new, if you're not generating new methods or producing new information and insights?
    – aeismail
    Sep 2, 2013 at 15:42
  • The 'new' bit would be that I am the first to actually do the analysis. The new result I guess is 'Everything's fine. Nothing is wrong.' I'm not sure that's enough for a paper.
    – jhoyla
    Sep 2, 2013 at 16:13
  • @jhoyla that could be a paper based on a validation of the method.
    – user7130
    Sep 2, 2013 at 19:20
  • @jhoyla I edited in a suggestion to consider doing a company white paper
    – user7130
    Sep 2, 2013 at 19:59

Obviously, without the details, I cannot say for sure, but I'd guess that Yes, it is publishable.

  1. If more senior people think it is publishable (and it seems they have some experience with the scientific process even though this is an industry setting), then I tend to trust their judgement over yours. Often, when starting out, people tend to think that only major breakthroughs can be published; when it is very much not the case. This is a fairly common occurrence with young researchers: that they are too publication shy. (Others are too quick to think something is ready to be published).

  2. It is obviously novel that this particular protocol has these properties even if the protocol itself has been published already (or is published separately) or the techniques to get to the result are also not novel. The question is whether it is interesting and non-obvious enough. If it is really a trivial thing, then it may not be worth publishing even if it novel. Alternatively, if the protocol itself is not very interesting or used, then it may be deemed not interesting, which is a different criterion from non-novel.

  3. Given the above, the quality of the actual paper (as opposed to the raw analysis) will also need to be taken into account. It is more publishable if you can tie these particular results to a wider framework so as to locate it into a larger body of work. Again, it is hard to say for sure what this might be without knowing more details.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .