# Does encrypting with MGF1/SHA-512/1024-bit seed equal to a 1024-bit key block cipher?

Suppose:

1. Alice uses SHA-512 with MGF1(as in PKCS#1 V2) and a 1024-bit random seed to generate a mask, XORs the mask with a message(M), gets a cipher text (CT), and sends the CT to her old friend Bob. Of course, curious Eve is listening...

2. Alice and Bob exchange the seed in a secure way (while Eve sleeps and does not know about it); they do not care about the speed of this algorithm.

Questions:

1. Is CT as secure as being encryted by a 1024-bit block cipher?

2. Why?

• 1) It does not meet the definition of a block-cipher because it doesn't have separate inputs for key and message and produces a ciphertext with the same length as the plaintext. 2) It's only a two round feistel network, to be a secure block-cipher (strong PRP), you need four rounds. – CodesInChaos Mar 3 '16 at 11:07
• It's a stream cipher, not a block cipher. – SEJPM Mar 3 '16 at 11:07
• @SEJPM Yes, it is a stream cipher. But how to measure its security strength? – Leo.W Mar 3 '16 at 20:03
• @CodesInChaos Thank you for your answer. I will check the feistel network. – Leo.W Mar 3 '16 at 20:05

The security—meaning the attacker's expected cost to break it—is at most $$2^{512}/t$$ if there are $$t$$ users of the system.
How the best possible security of this system relates to the best possible security of a 1024-bit block cipher depends on the block cipher. The idealization of this system—a uniform random 1024-bit pad—has the same security as an ideal 1024-bit block cipher. But a practical block cipher has a key, and it is typically smaller than $$\log_2 2^{1024}! \approx 1024 \cdot 2^{1024}$$ bits long.
• You're encrypting the message with a one-time pad: $c = m \oplus p$. You're generating the pad with SHA-512. If you authenticate a message with CBC justified by the information-theoretic CBC theorem, but transform the blocks with AES instead of using a uniform random function, is it no longer CBC? If you choose the AES key by a KDF instead of by 256 fair coin tosses, is it no longer AES? If you use Poly1305 with a key chosen by RSA-KEM, is it no longer a one-time MAC? Of course not; that would be a pointless denial of terminology. – Squeamish Ossifrage Apr 19 '19 at 3:27
• There's no practical or theoretical merit to changing the name of the model when you replace a random variable by a pseudorandom function of a random variable, whether for one-time pads, one-time MACs, CBC, or any other models. Insisting on special status for the term ‘one-time pad’ only encourages people to shoot themselves in the foot by the misapprehension that the pseudorandom function is an evil to be avoided instead of an essential device to make what is fundamentally a very limited idea—$c = m \oplus p$—practically secure. – Squeamish Ossifrage Apr 19 '19 at 3:43