It is possible to use a hash function to construct a block cipher with a structure similar to DES? Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible?
migrated from security.stackexchange.com Nov 8 '12 at 12:26
This question came from our site for Information security professionals.
It is possible to build a block cipher out of a great many things. If you want to use a hash function, the classic trick is to follow a Feistel structure, which is, incidentally, the same kind of structure than what DES uses.
The schematics on the Wikipedia page are quite clear; you would use the hash function for the "F" part, which combines one (sub)key and one half of the current block, to produce a value which is to be XORed with the other half of the current block. The beauty of the scheme is that the "F" function is always invoked in the same direction, both for encryption and for decryption. Therefore, it can be a one-way function, like a hash function.
Luby and Rackoff have demonstrated in 1988 that the Feistel scheme offers remarkable security with as little as four rounds, provided that the "F" function is "perfect" and that the cipher block size is big enough (to get the standard "128-bit security" out of the Luby-Rackoff proof, you need 256-bit blocks).
Of course, any concrete hash function cannot be really "perfect" (see for instance this answer) and there are a lot of subtle details which can destroy the security of the best thought cipher structure. As usual, you are strongly advised not to build your own crypto (unless you are quite clear with yourself that you do it for learning and not to actually protect any data of value).
Also, if you build such a cipher, you will probably notice that the resulting performance is disappointing. With a secure hash function like SHA-256, you could expect an encryption bandwidth roughly 20 times lower than what AES would get you.
It is possible to use a hash function like (SHA family, for instance) in OFB or CFB (and possibly CTR), by using the hash function (with the key as part of the input!) in the place of the block cipher encryption. That said, Thomas is right -- DO NOT BUILD YOUR OWN CRYPTO. Just use a normal block cipher. You'll get better performance (especially if it's AES and you're on hardware with ways to accelerate it), and you'll probably get better security (at least you'll know it's been examined).