# Is simple XOR with secret key using DHE secure?

Client and server have given generator 3 and modulus which is 256 bit prime same all the time for all clients and server (simply hardcoded).

They both generate a private exponent and send result to each other and generate secure key. This all is done over insecure channel. That's all simple Diffie-Hellman exchange.

After this step every sent packet is encrypted over simple XOR block cipher by secure key's bytes, in this case 256bit long block.

Is this way of encryption any secure and if yes, how much, if no, what are ways to reverse it, as it is so simple and doesn't use much resources?

• Apart from the XOR weaknesses already noted, you should also be aware that "simple Diffie-Hellman" is trivially vulnerable to a man-in-the-middle attack unless you extend it with some way of verifying that you're in fact talking to who you think you're talking to during the key exchange. You need either a shared secret and a MAC or some kind of public-key signing of the $g^x$ values. – Henning Makholm Sep 10 '15 at 0:32

After this step every sent packet is encrypted over simple XOR block cipher by secure key's bytes, in this case 256bit long block.

Does this mean "divide the message into 256-bit blocks, and XOR each block with the key"? If so, this is very insecure. If any part of the message is predictable, the attacker can recover part or all of the key, and potentially decrypt the rest of the message and any future messages under that key.

Another problem: if the attacker has some knowledge of the structure of the plaintext (e.g. it's a JSON object), they can tamper with the message to change what it says.

The usual solution to these problems is to use the key with an authenticated encryption mode like AES-GCM.

• Data are binary, serialized hash-map. How does AES-GCM performance compare to simple XOR in number of operations to be done and what would be maximal key length? – jakubinf Sep 9 '15 at 19:22
• AES-GCM is way slower, but it's not really a useful comparison. This XOR scheme provides approximately zero protection in any real-world situation. (and if security isn't important, then why encrypt it all?) – Tim McLean Sep 9 '15 at 19:26
• As I look over AES-GCM now, how should be AAD and Nonce generated then when only secret key is known on both sides? Or can it be hardcoded as well? – jakubinf Sep 9 '15 at 19:48
• AAD is optional, you can leave it out. Nonce can be randomly generated each time you encrypt, and transmitted unencrypted (it just has to be different each time). – Tim McLean Sep 9 '15 at 19:54

In addition to the problems that user595228 has mentioned, well, an attacker can easily solve a discrete log modulo a 256 bit prime; from that, he can recompute the shared secret, and that would give him the entire message. To be secure, you really need at least a 1024 bit prime; with a 2048 bit prime being greatly preferred.

• Well, even 8192 bits long prime is not problem, so are you saying that XOR cipher with big enough prime could be secure as well? – jakubinf Sep 9 '15 at 19:46
• @jakubinf: no, you still have to worry about the attacks that uer595228 pointed out. – poncho Sep 9 '15 at 19:48