1
$\begingroup$

I've read some Q&A about combining OTP with hash on this site, but I still wonder why some answers said that using hash for OTP key is not strong enough to resist brute force attack?

Assuming that the key is never reused and the adversary has unlimited computational resources so that the adversary can try all keys easily. Is the adversary able to find out which one is correct from all of the plaintexts after getting all possible plaintexts?

For example, if the adversary gets "Give me 100 dollars.", then he might get "Give me 200 dollars." too. If he can't filter out the wrong plaintext, how does he know the correct key and crack it?

I know the amount of possible plaintext depends on the amount of possible hash value, but if the adversary gets at least two possible plaintexts and has no any method to distinguish the right one from them, will this cipher encrypted by hash key have any chance to be cracked by brute force attack? If no, then are there any flaws in this encryption technique? (Ignore the message authentication problem)

Improve this question
$\endgroup$
5
  • $\begingroup$ Ok, could you add an equation or similar to show exactly what you mean? $\endgroup$
    – otus
    Commented Jul 16, 2016 at 7:19
  • $\begingroup$ This post is where my question from. I mean, for example, if I have a key generated by pbkdf2 and XOR it with plaintext then the adversary gets all the possible plaintexts and keys by brute force attack. How does he know which one is my real key? $\endgroup$
    – Qoo
    Commented Jul 16, 2016 at 7:28
  • $\begingroup$ Do you assume 1) single use for the key and 2) a message that is no longer than the hash output (e.g. 256 bits)? $\endgroup$
    – otus
    Commented Jul 16, 2016 at 7:34
  • $\begingroup$ Yes, that's it. $\endgroup$
    – Qoo
    Commented Jul 16, 2016 at 7:37
  • $\begingroup$ In today's sense of security, statements about ciphertext-only attacks and brute-forcing are only of interest when it comes to weak passwords. For anything else, e.g. cryptosystems, stronger notions of security are used. Mixing hashes and encryption on a whim is bad in general, because the security definitions differ in details, which could make it insecure, but it depends on what you actually do and there isn't any cryptanalysis of that specific construction. $\endgroup$
    – tylo
    Commented Jul 18, 2016 at 12:43

1 Answer 1

Reset to default
1
$\begingroup$

If you are imagining something like 256+ bits of key -> SHA-256 -> one block keystream that you XOR with the plaintext, that is indeed almost the same as one-time pad. However, there is no advantage to doing that, considering you might as well have used the original key directly as a one-time pad.

If, instead you use a password-based hash, a dictionary attack or similar can be successful, and unless the password has more entropy than the output size of the hash, the attacker can at least rule out some possible messages, meaning it lacks perfect secrecy.

Even in the first case, where your key is high entropy, the fact that you run it through a hash function will affect the possible outputs and their frequencies, so a computationally unbounded adversary would gain some information about the contents of the message – some options may be impossible and some may be more probable.

In practice, using a (password-)hash to produce a keystream amounts to a stream cipher, and assuming your key/password has enough entropy and you do not reuse the same key/password for other messages, it is very likely secure. From a confidentiality point of view, that is: stream ciphers (and OTP) are malleable so you want authentication if the integrity of the message matters.

(Insert obligatory recommendation to use standard ciphers in practice.)

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.