It is possible to use a hash function to construct a block cipher with a structure similar to DES? Because a hash function is one way and a block cipher must be reversible (to decrypt), how is it possible?
4 Answers
$\begingroup$
$\endgroup$
It is possible to build a block cipher out of a great many things. If you want to use a hash function, the classic trick is to follow a Feistel structure, which is, incidentally, the same kind of structure than what DES uses.
The schematics on the Wikipedia page are quite clear; you would use the hash function for the "F" part, which combines one (sub)key and one half of the current block, to produce a value which is to be XORed with the other half of the current block. The beauty of the scheme is that the "F" function is always invoked in the same direction, both for encryption and for decryption. Therefore, it can be a one-way function, like a hash function.
Luby and Rackoff have demonstrated in 1988 that the Feistel scheme offers remarkable security with as little as four rounds, provided that the "F" function is "perfect" and that the cipher block size is big enough (to get the standard "128-bit security" out of the Luby-Rackoff proof, you need 256-bit blocks).
Of course, any concrete hash function cannot be really "perfect" (see for instance this answer) and there are a lot of subtle details which can destroy the security of the best thought cipher structure. As usual, you are strongly advised not to build your own crypto (unless you are quite clear with yourself that you do it for learning and not to actually protect any data of value).
Also, if you build such a cipher, you will probably notice that the resulting performance is disappointing. With a secure hash function like SHA-256, you could expect an encryption bandwidth roughly 20 times lower than what AES would get you.
answered Nov 7, 2012 at 17:49
$\begingroup$
$\endgroup$
It is possible to use a hash function like (SHA family, for instance) in OFB or CFB (and possibly CTR), by using the hash function (with the key as part of the input!) in the place of the block cipher encryption. That said, Thomas is right -- DO NOT BUILD YOUR OWN CRYPTO. Just use a normal block cipher. You'll get better performance (especially if it's AES and you're on hardware with ways to accelerate it), and you'll probably get better security (at least you'll know it's been examined).
$\begingroup$
$\endgroup$
1
Although I'm certainly not going to recommend using it, one well known way to do this is to hash the previous ciphertext block concatenated with the key, then XOR the result with the current plaintext block.
In this case, the block size is equal to the length of one output from the hash function. In effect, is uses the hash about like a block cipher in CFB mode. It's possible (and only slightly more complex) to get roughly the same, but with essentially OFB mode as well.
There's another construction called MDC (invented by Peter Gutmann) that turns a secure hash into a block cipher that runs in CFB mode. This is a little more complex, but I'd guess that searching for "Gutmann MDC" or something similar should turn up details if you really want to know about it.
Both of these are fairly straightforward applications of the standard modes of operation. There's been quite a bit of study and proofs have been written to show that applying an algorithm using either CFB or OFB basically preserves all the security of the underlying cipher.
The problem is that good secure hashes have normally be studied only as...secure hashes, not as encryption algorithms. You're using the hash function in question in a way that it wasn't really designed for, and most haven't been studied in this kind of application. Many (most?) of the standard attacks on encryption (e.g., differential/linear cryptanalysis) aren't normally meaningful with respect to a hash function, but would become applicable to one applied in these ways to create an encryption function--and it's unlikely that anybody's studied how well they resist such attacks when applied this way.
In other words: if you're interested in basic ideas of how encryption can work, go ahead study these--they're certainly quite interesting. If you're looking for a practical way to do encryption, you almost certainly want to avoid them; there normal algorithms are clearly preferable for most situations.
-
$\begingroup$ I believe this is technically a mode of turning a hash function into a stream cipher (symmetric encryption), not specifically a block cipher. However the question was pretty vague and was probably meant to mean symmetric encryption algorithm $\endgroup$ Commented Jan 27, 2016 at 3:40
$\begingroup$
$\endgroup$
For Feistel ciphers such as DES, encryption and decryption are performed using the same algorithm – decryption simply uses the round keys in the reverse order as encryption. If a hash function was substituted for the round function of a Feistel cipher, then there would be no round keys and encryption and decryption would use the same algorithm – the cipher would be reversible. Any security imparted by the cipher, however, would be dependent on keeping the hash function itself secret.
Source: page 3 of the group assignment notes related to “Public Key Cryptography” (PDF)
I mean you're not even talking in terms of rotating keys yet. Beautiful.
