Rate my idea: is that a stronger GPG-like algorithm?

Question

I came up with a simple idea but I don't know if it is really secure or not. I know that you shouldn't create any algorithm on your own. I'm just curious, that's all.

Algorithm explanation:

• First of all, Alice and Bob agree on a common secret password, lets say P1 (this should be done using a secure channel, like meeting in real life just a single time to exchange the password which is more practical than exchanging one time pads)

• Alice chooses one secret passwords, lets say A1, which she keeps secret, Bob does the same, B1

• Alice hashes her password and Bob does the same, so we have:

  HA1 = hash(A1) Alice's hashed password

  HB1 = hash(B1) Bob's hashed password

• Alice sends her hashed password (HA1) to Bob, even on a insecure channel, because it's hashed. Bob does the same: he sends her his hash HB1

• Let's say Alice wants to encrypt something. She would to the following:

  1. Take P1 (the common password) and hash it so HP1 = hash(P1)

  2. Take Bob's hashed password HB1

  3. Encrypt the message using this long password (just a concatenated string) = (HB1 + HP1)

• When Bob's gets the message, he has to:

  1. Insert two different passwords: his private password + the common shared password

  2. The algorithm transforms those two words in their hashes and then tries to decrypt the message

In my opinion, this would be great because:

1. If Alice encrypts a message with Bob's hashed password, even if someone knows the shared password, only Bob can decrypt the message

2. If someone finds Alice's or Bob's private password, he can't still encrypt/decrypt anything because he doesn't know the common one

3. Only Alice knows the common password, so Bob's is sure that the cypher is surely made by Alice (no MITM attacks, fake identity like in GPG)

4. You have to share a common word just once. This solves the key distribution problem of the OTP method

What do you guys think?

Answer 1

Your idea is no stronger than simply having a common shared password $P_1$ from which the symmetric encryption key is derived.

If Alice encrypts a message with Bob's hashed password, even if someone knows the shared password, only Bob can decrypt the message

You assumed the hash of Bob's password – $H(B_1)$ – is public, so if Eve knows both it and the common password $P_1$ she can calculate $H(B_1)||H(P_1)$. She doesn't need to know $B_1$ itself.

A program can be written to require the password $B_1$, but Eve could write her own program that accepts either the hashes or the passwords.

I.e. unless you assume $H(A_1)$ and $H(B_1)$ are private, they do nothing. If you do assume that, they effectively become part of the shared secret.

Only Alice knows the common password, so Bob's is sure that the cypher is surely made by Alice (no MITM attacks, fake identity like in GPG)

Yes, but the problem of sharing the common password $P_1$ remains. If you can securely exchange that password, you can likewise securely exchange GPG keys or any other encryption keys.