If encrypting with a hash function in counter mode, will the security of this scheme be at most minimal{input,output}?

Question

It's possible to use a hash function as an encipherment scheme if used in counter mode.

Let's suppose I take a 64-bytes (512-bits) seed/key and hash it concatenated with counters, and use it as a encipherment scheme. But the hash function has its digest output size of 32-bytes.

Some hash function such as Blake2 and Blake3 have options for specifying an counter, but counters can be used with any (criptographic) hash functions using the following scheme:

H(00∥S)∥H(01∥S)∥H(02∥S)∥H(03∥S)∥…

H is the hash, 00/01/02/03 the counters and S the seed (key).

If I use this 64-bytes seed with a hash function with a digest output size of 32-bytes, will the security of this encipherment scheme be at most minimal{input,output}? Or will be 512-bits (same size of the seed/key)?

I'm asking this because using a 64-bytes seed and having 32-bytes of digest size (256-bits), 2^256 another seeds of the same 64 bytes size will produce the same output.

Answer 1

If I use this 64-bytes seed with a hash function with a digest output size of 32-bytes, will the security of this encipherment scheme be at most minimal{input,output}? Or will be 512-bits (same size of the seed/key)?

Assuming the hash function be reasonably be modeled as a random function, the security will be the size of the input (in this case, 512 bits).

Consider the extreme case: suppose we used only 1 bit from each hash output to encrypt - would we be able to break it trivially (as $2^1$ is quite small)?

I'm asking this because using a 64-bytes seed and having 32-bytes of digest size (256-bits), 2^256 another seeds of the same 64 bytes size will produce the same output.

That's not true. It is true that, for the first 256 bits, there will likely be about 2^256 other seeds that generate those same first 256 bits. However, if we were then to consider the second 256 bits, $H(00\#S_1) == H(00\#S_2)$ does not imply that $H(01\#S_1) == H(01\#S_2)$, and so (with high probability) those latter bits will differ.

And, this is no different than what would happen if we used a 512 bit hash function; if we consider only the first 256 bits of output, of course there was a lot of collisions (there are loads of collisions for any function that takes 512 bits of input and produces 256 bits of output)