I'm being asked to use a crypto algorithm in my code, and besides the fact that I'm sure there will be implementation faults that lead to vulnerabilities, I also have concerns about the algorithm itself. I'd like to know how strongly I need to convince these guys to not use this. If it is an acceptable algorithm and there is a name for it, I'd like to know so I can find an implementation of it somewhere (I've been trained to not implement my own crypto).

I'm not a cryptographer, and this is coming from a large company and from people with much more programming experience than I have, so if I do need to convince people not to use this, it will be difficult.

The algorithm starts with a secret concatenated with a random string the length of an MD5 digest. It MD5 digests this initial string and XORs the digest with the input data (up to the length of the MD5 digest). It takes the result of that XOR operation, saves it to the output buffer and digests it concatenated with the original secret to get a new digest, and it keeps going until it has covered the whole input.

--EDIT--

The goal of this scheme is to allow messages to be read by parties who know a secret and to not allow messages to be read by parties who don't know the secret.

Now that I understand the notation, I can make this clearer:

$C_1 = M_1 \oplus \operatorname{MD5}( secret || random )$

$C_n = M_n \oplus \operatorname{MD5}( secret || C_{n-1} )$

I also don't understand how this is to be decrypted - it seems like the same random string is needed for that, in which case, we have the problem of how to get the random string to the other parties - is it okay for that part to be sent in plaintext?

I'm being asked to use an encryption algorithm in my code, and besides the fact that I'm sure there will be implementation faults that lead to vulnerabilities, I also have concerns about the algorithm itself. I'd like to know how strongly I need to convince these guys to not use this. If it is an acceptable algorithm and there is a name for it, I'd like to know so I can find an implementation of it somewhere (I've been trained to not implement my own crypto).

I'm not a cryptographer, and this is coming from a large company and from people with much more programming experience than I have, so if I do need to convince people not to use this, it will be difficult.

1. The algorithm starts with a secret concatenated with a random string the length of an MD5 digest.
2. It MD5-digests this initial string and XORs the digest with the input data (up to the length of the MD5 digest).
3. It takes the result of that XOR operation, saves it to the output buffer and digests it concatenated with the original secret to get a new digest.
4. Then it keeps going until it has covered the whole input.

The goal of this scheme is to allow messages to be read by parties who know a secret and to not allow those messages to be read by parties who don't know the secret.

Now that I understand the notation, I can make this clearer:

$C_1 = M_1 \oplus \operatorname{MD5}( secret || random )$

$C_n = M_n \oplus \operatorname{MD5}( secret || C_{n-1} )$

I also don't understand how this is to be decrypted. It seems like the same random string is needed for that, in which case, we have the problem of how to get the random string to the other parties – is it okay for that part to be sent in plaintext?

I'm being asked to use a crypto algorithm in my code, and besides the fact that I'm sure there will be implementation faults that lead to vulnerabilities, I also have concerns about the algorithm itself. I'd like to know how strongly I need to convince these guys to not use this. If it is an acceptable algorithm and there is a name for it, I'd like to know so I can find an implementation of it somewhere (I've been trained to not implement my own crypto).

I'm not a cryptographer, and this is coming from a large company and from people with much more programming experience than I have, so if I do need to convince people not to use this will be difficult.

The algorithm starts with a secret concatenated with a random string the length of an MD5 digest. It MD5 digests this initial string and XORs the digest with the input data (up to the length of the MD5 digest). It takes the result of that XOR operation, saves it to the output buffer and digests it concatenated with the original secret to get a new digest, and it keeps going until it has covered the whole input.

--EDIT--

The goal of this scheme is to allow messages to be read by parties who know a secret and to not allow messages to be read by parties who don't know the secret.

Now that I understand the notation, I can make this clearer:

$C_1 = M_1 \oplus \operatorname{MD5}( secret || random )$

$C_n = M_n \oplus \operatorname{MD5}( secret || C_{n-1} )$

I also don't understand how this is to be decrypted - it seems like the same random string is needed for that, in which case, we have the problem of how to get the random string to the other parties - is it okay for that part to be sent in plaintext?

I'm being asked to use a crypto algorithm in my code, and besides the fact that I'm sure there will be implementation faults that lead to vulnerabilities, I also have concerns about the algorithm itself. I'd like to know how strongly I need to convince these guys to not use this. If it is an acceptable algorithm and there is a name for it, I'd like to know so I can find an implementation of it somewhere (I've been trained to not implement my own crypto).

I'm not a cryptographer, and this is coming from a large company and from people with much more programming experience than I have, so if I do need to convince people not to use this, it will be difficult.

The algorithm starts with a secret concatenated with a random string the length of an MD5 digest. It MD5 digests this initial string and XORs the digest with the input data (up to the length of the MD5 digest). It takes the result of that XOR operation, saves it to the output buffer and digests it concatenated with the original secret to get a new digest, and it keeps going until it has covered the whole input.

--EDIT--

The goal of this scheme is to allow messages to be read by parties who know a secret and to not allow messages to be read by parties who don't know the secret.

Now that I understand the notation, I can make this clearer:

$C_1 = M_1 \oplus \operatorname{MD5}( secret || random )$

$C_n = M_n \oplus \operatorname{MD5}( secret || C_{n-1} )$

I also don't understand how this is to be decrypted - it seems like the same random string is needed for that, in which case, we have the problem of how to get the random string to the other parties - is it okay for that part to be sent in plaintext?