Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey).

Would it be secure to feed it like a block cipher in counter mode to get a random pad suitable as an stream cipher?

Of course, I'm talking about not repeating the counter value ever to encrypt data (so this construction would also need some random IV or treating the counter value as a nonce forever).

share|improve this question
Yes, CTR mode works with any PRF. HMAC-SHA1 is a decent PRF. – CodesInChaos Jan 9 '14 at 13:26
Thanks for the pointer. In wikipedia there's a pointer to a paper which proves that HMAC is a PRF under the sole assumption that the compression function is a PRF (see – izaera Jan 9 '14 at 13:56
@CodesInChaos: BTW, is SHA-1 a PRF? If so, why? Are all crypto hashes PRFs by definition or is it something that must be proved one by one? Or is it simply that crypto hashes are "believed" to be PRFs? – izaera Jan 9 '14 at 15:31
A PRF is a keyed primitive, a hash isn't. So the terminology doesn't apply directly. But pretty much all symmetric crypto relies on belief. – CodesInChaos Jan 9 '14 at 15:40
@izaera: The compression function in that proof is the compression function of the underlying iterated hash scheme (SHA1). You can see one iteration of the compression function in the first diagram on this page. – Reid Jan 9 '14 at 17:15
up vote 10 down vote accepted

Yes, this would be secure. CTR (Counter) mode based on keyed function $F_K$ is secure as long as its output $$ W_i = F_K(i) $$ is unpredictable given previous outputs $$ F_K(1),F_K(2),\ldots,F_K(i-1). $$ This requirement is essentially the definition of a pseudo-random function (PRF). Most HMAC instantiations with widely used hash functions are believed to be secure PRFs (rigorous proofs are impossible for several reasons).

You may have heard of CTR mode as a blockcipher mode. This is also correct, as a secure block cipher must be a secure pseudo-random permutation (PRP), which can not be distinguished from PRF if it is queried/used fewer than $2^{n/2}$ times, where $n$ is the block size.

Block ciphers are used in CTR mode primarily due to their speed (HMAC is slower, in particular on short messages), but keyed hash functions are equally strong.

Certainly, you must ensure that your counter never repeats. You may want to follow the NIST strategy (page 18) of constructing the counter from nonce.

share|improve this answer

In his book “Applied Cryptography”, Bruce Schneier says about "Ciphers Based on one-Way Hash Functions":

The simplest way to encrypt with a one-way function is to hash the previous ciphertext block concatenated with the key, then XoR the result with the current plaintext block:

$C_i = P_i \oplus H(K, C_{i-1}) \\ P_i = C_i \oplus H(K, C_{i-1})$

Set the block length equal to the output of the one-way hash function. This, in effect uses the one- way function as a block cipher in CFB mode. A similar construction can use the one-way function in OFB mode:

$C_i = P_i \oplus S_i ; S_i = H(K, C_{i-1}) \\ P_i = C_i \oplus S_i ; S_i = H(K, C_{i-1})$

The security of this scheme depends on the security of the one-way function.

This is uses the one- way function as a block cipher id OFB and CFB mode. this method can be used as stream cipher since the $C_i$ generated using XOR operation.

In relation to the “Security of Ciphers Based on one-Way Hash Functions”, Bruce Schneier states:

While these constructions can be secure, they depend on the choice of the underlying one-way hash function. A good one-way hash function does not necessarily make a secure encryption algorithm. Cryptographic requirements are different. For example, linear cryptanalysis is not a viable attack against one-way hash functions, but works against encryption algorithms. A one-way hash function such as SHA could have linear characteristics which, while not affecting its security as a one-way hash function, could make it insecure in an encryption algorithm such as MDC. I know of no cryptanalytic analysis of particular one-way hash functions as block ciphers; wait for such analysis before you trust any of them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.