Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Let's suppose I take 1MiB of truly random data and split in pieces (seeds) of 32-bytes (256-bits), so I hash each seed with a hash function with the same output digest size (32-bytes/256-bits) and XOR each piece of hashed seeds into a 1MiB plaintext.
The random data is kept secret.
My question is:
Will this scheme have the same security of One-time pad?
Will this scheme have the same security of One-Time Pad?
Not in theory, facing arbitrary powerful adversaries. E.g. it's overwhelmingly probable that such adversaries could distinguish among two ciphertexts which one is for input that consists of zeroes, when the other is for input that consists of ones. They can't for the OTP. Such arbitrary powerful adversary uses that the distribution of the 256-bit hashes is not uniform, and in particular does not reach about 37% of the 256-bit outputs.
But yes in practice for a good unbroken hash like SHA-256 and an actual thus compute-bound adversary.
Not quite.
Hash functions by definition are surjective. That means their outputs collide given multiple differing inputs. That creates a bias. E.g. So with a 256 bit input, you'll lose 50% of your inputted entropy to achieve an acceptable $2^{-64}$ bias. That's in accordance with the Left Over hash lemma. That's vaguely also where the idea of entropy halving after hashing arises.
I assume that "1MiB of truly random data " means 8 bits of entropy per byte.
If I hash different seeds with the same size of hash output and XOR on plaintext, is it secure as a One-time pad?
Ignoring the 256-bit blocks specified in the question body, the answer to the question in the title depends on the hash length.
Consider a block size of 1 byte. A hash function with 8-bit output will map each byte into a random other byte. But some of the input bytes will map into the same output - on average there will be 161 distinct output values for the 256 distinct input values. A one-time pad covering only 63% of byte values is clearly not as secure as a proper one-time pad.
At the other extreme, you can consider a hash input block size of twice the message length. At this point, it is almost certain that the hash output after truncation to message length will cover all values close to uniformly, and is equivalent to a random one-time pad.
Where exactly the threshold lies will depend on message contents and how much other information is available for cryptanalysis. Without knowledge of message structure, a one-time pad is not vulnerable to direct brute forcing. Even a very weak pad couldn't be broken if you don't have a way to verify that the decryption is correct. For highly structured and repetitive content, even 256-bit hashing could have enough of a bias to distinguish the encrypted data.
