# Stream cipher with Diffie-Hellman and Cryptographic Hash Function?

I know: Never do your own crypto.

But this question is just theoretical.

Assume you do a Diffie-Hellman Key Exchange with a server to produce a shared secret $x$. Then use a cryptographic hash function like SHA3 to generate a pseudorandom bitstream like this:

$$p_i = \operatorname{SHA3}(x||p_{i-1}).$$

To encrypt $i$th packet of data, labelled $m_i$, compute

$$c_i = m_i \oplus p_i.$$

I realize that the key stream for a OTP must be completely random to ensure perfect secrecy, but would this scheme at least be as hard to break as the underlying hash function or Diffie-Hellman?

In my opinion, it should be, but I'm new to cryptography.

Since the shared secret is only used for one session, assuming the hash function is a random oracle, no keystream is ever used twice. By including $x$ in every $p_i$ an attacker has to break (not only find a collision) the first sent packet in order to decrypt the rest of the session, breaking any other packet will most likely be a collision and not give away the needed $x$, only the content of this packet. Also, breaking any packet requires at least plaintext knowledge but it gives you only this particular hash, not the previous/next hashes.

-
If the key stream is not completely random, it is not called OTP, but a stream cipher. –  Henrick Hellström Jul 8 at 16:18
Take a look at this and this –  rath Jul 8 at 22:11

You've just invented your own stream cipher. Rather than trying to make sure it is secure, it is better to use a stream cipher that is already known, such as AES-CTR or AES-GCM (which adds an authentication tag). Also note that stream ciphers based on secure hash functions are relatively slow compared to most stream ciphers.

-