# If encrypting with a hash function in counter mode, will the security of this scheme be at most minimal{input,output}?

It's possible to use a hash function as an encipherment scheme if used in counter mode.

Let's suppose I take a 64-bytes (512-bits) seed/key and hash it concatenated with counters, and use it as a encipherment scheme. But the hash function has its digest output size of 32-bytes.

Some hash function such as Blake2 and Blake3 have options for specifying an counter, but counters can be used with any (criptographic) hash functions using the following scheme:

H(00∥S)∥H(01∥S)∥H(02∥S)∥H(03∥S)∥…


H is the hash, 00/01/02/03 the counters and S the seed (key).

If I use this 64-bytes seed with a hash function with a digest output size of 32-bytes, will the security of this encipherment scheme be at most minimal{input,output}? Or will be 512-bits (same size of the seed/key)?

I'm asking this because using a 64-bytes seed and having 32-bytes of digest size (256-bits), 2^256 another seeds of the same 64 bytes size will produce the same output.

Consider the extreme case: suppose we used only 1 bit from each hash output to encrypt - would we be able to break it trivially (as $$2^1$$ is quite small)?
That's not true. It is true that, for the first 256 bits, there will likely be about 2^256 other seeds that generate those same first 256 bits. However, if we were then to consider the second 256 bits, $$H(00\#S_1) == H(00\#S_2)$$ does not imply that $$H(01\#S_1) == H(01\#S_2)$$, and so (with high probability) those latter bits will differ.