I have an application that encrypts files in the following manner (I think I can hear sighs already but bear with me):
- Start with two byte arrays generated from random strings of lengths l1 and l2 (fwiw, l1 and l2 are primes)
- Loop through both arrays (nested loop) and generate a third array of length l1 * l2 where each byte is the result of XORing the indexed bytes of the other arrays
- Accept a password from the user and then successively XOR every byte in the third array, looping through the bytes of the password
The aim by this point is to have a key which is based on the password and longer than the data being encrypted which can then be used to quickly encrypt and decrypt the files.
I could have just used the password itself to XOR the file but I wanted to avoid the appearance of repeating sequences that might occur due to a password that is shorter than the data.
Now I'm not a mathematician or a cryptographer and I know that inventing my own security like this is a fool's game - but it's just for a pet project and is not being used for anything critical.
So the question is, how secure does this all sound? I suppose it'd be easy to get the generated key if you passed a large file of zeros and were able to examine the output but lets assume a hypothetical attacker only had access to a set of encrypted files (let's say JPEGs).
Apologies if this sort of thing has been asked before (I did try looking) and if I sound a bit naive!