Using SHA-256 as a stream cipher appears to bear cryptographic weaknesses, however, I am not quite sure how to implement them in decryption.
Assume that I have an encryption function using 64-byte blocks. I encrypt each of the blocks with the hash of the previous to produce my ciphertext. The weak link here is, that I know, or can guess the very first block of bytes.
In one of the posts linked below, I read:
I should mention that if there is any full block of known or guessable plaintext in your message, your scheme is easily broken because given pad(i) anyone can compute pad(i+1). So guess one block of plaintext, XOR it against the ciphertext to recover a possible pad value, then compute the next pad value and see if the recovered ciphertext in that block seems valid.
Can anyone elaborate on what exactly is meant here? If I know the first block, do I xor it against the hashed first block? If so how does that help me crack the next hashes that are H(prevHashedBlock + currentPlaintextBlock)?
I am aware this has to do with hashing states and such but I haven't found much on the web.
I have read the following posts:
Is it feasible to build a stream cipher from a cryptographic hash function?
Is SHA-256 secure as a CTR block cipher?