0
$\begingroup$

Suppose:

  1. Alice uses SHA-512 with MGF1(as in PKCS#1 V2) and a 1024-bit random seed to generate a mask, XORs the mask with a message(M), gets a cipher text (CT), and sends the CT to her old friend Bob. Of course, curious Eve is listening...

  2. Alice and Bob exchange the seed in a secure way (while Eve sleeps and does not know about it); they do not care about the speed of this algorithm.

Questions:

  1. Is CT as secure as being encryted by a 1024-bit block cipher?

  2. Why?

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ 1) It does not meet the definition of a block-cipher because it doesn't have separate inputs for key and message and produces a ciphertext with the same length as the plaintext. 2) It's only a two round feistel network, to be a secure block-cipher (strong PRP), you need four rounds. $\endgroup$
    – CodesInChaos
    Commented Mar 3, 2016 at 11:07
  • $\begingroup$ It's a stream cipher, not a block cipher. $\endgroup$
    – SEJPM
    Commented Mar 3, 2016 at 11:07
  • $\begingroup$ @SEJPM Yes, it is a stream cipher. But how to measure its security strength? $\endgroup$
    – Leo.W
    Commented Mar 3, 2016 at 20:03
  • $\begingroup$ @CodesInChaos Thank you for your answer. I will check the feistel network. $\endgroup$
    – Leo.W
    Commented Mar 3, 2016 at 20:05
  • $\begingroup$ @CodesInChaos Please don’t get me wrong, but what happened to “Use comments to ask for more information or suggest improvements. Avoid answering questions in comments.”? $\endgroup$
    – e-sushi
    Commented Mar 4, 2016 at 10:54

1 Answer 1

Reset to default
1
$\begingroup$

This is not a block cipher. It is a stream cipher: you are using SHA-512 to generate a one-time pad to encrypt the message.

The security—meaning the attacker's expected cost to break it—is at most $2^{512}/t$ if there are $t$ users of the system.

How the best possible security of this system relates to the best possible security of a 1024-bit block cipher depends on the block cipher. The idealization of this system—a uniform random 1024-bit pad—has the same security as an ideal 1024-bit block cipher. But a practical block cipher has a key, and it is typically smaller than $\log_2 2^{1024}! \approx 1024 \cdot 2^{1024}$ bits long.

In practical terms, you should focus more on everything else about your application's security. For example, you didn't mention authentication, which suggests I can possibly destroy confidentiality by forging messages like EFAIL. There is no point in pushing anything beyond a 256-bit security level, if there was any point going beyond a 128-bit security level in the first place as you get with AES-256-GCM or crypto_secretbox_xsalsa20poly1305.

Improve this answer
$\endgroup$
3
  • $\begingroup$ s/one-time pad/keystream/ (yes, I know that they're functionally equivalent given the assumption that SHA-512 is a strong PRF, but not from an information theoretic standpoint, however useless in practice). $\endgroup$
    – forest
    Commented Apr 19, 2019 at 1:08
  • $\begingroup$ You're encrypting the message with a one-time pad: $c = m \oplus p$. You're generating the pad with SHA-512. If you authenticate a message with CBC justified by the information-theoretic CBC theorem, but transform the blocks with AES instead of using a uniform random function, is it no longer CBC? If you choose the AES key by a KDF instead of by 256 fair coin tosses, is it no longer AES? If you use Poly1305 with a key chosen by RSA-KEM, is it no longer a one-time MAC? Of course not; that would be a pointless denial of terminology. $\endgroup$
    – Squeamish Ossifrage
    Commented Apr 19, 2019 at 3:27
  • $\begingroup$ There's no practical or theoretical merit to changing the name of the model when you replace a random variable by a pseudorandom function of a random variable, whether for one-time pads, one-time MACs, CBC, or any other models. Insisting on special status for the term ‘one-time pad’ only encourages people to shoot themselves in the foot by the misapprehension that the pseudorandom function is an evil to be avoided instead of an essential device to make what is fundamentally a very limited idea—$c = m \oplus p$—practically secure. $\endgroup$
    – Squeamish Ossifrage
    Commented Apr 19, 2019 at 3:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.