# Does encrypting with MGF1/SHA-512/1024-bit seed equal to a 1024-bit key block cipher?

Suppose:

1. Alice uses SHA-512 with MGF1(as in PKCS#1 V2) and a 1024-bit random seed to generate a mask, XORs the mask with a message(M), gets a cipher text (CT), and sends the CT to her old friend Bob. Of course, curious Eve is listening...

2. Alice and Bob exchange the seed in a secure way (while Eve sleeps and does not know about it); they do not care about the speed of this algorithm.

Questions:

1. Is CT as secure as being encryted by a 1024-bit block cipher?

2. Why?

• 1) It does not meet the definition of a block-cipher because it doesn't have separate inputs for key and message and produces a ciphertext with the same length as the plaintext. 2) It's only a two round feistel network, to be a secure block-cipher (strong PRP), you need four rounds. Mar 3, 2016 at 11:07
• It's a stream cipher, not a block cipher. Mar 3, 2016 at 11:07
• @SEJPM Yes, it is a stream cipher. But how to measure its security strength? Mar 3, 2016 at 20:03
• @CodesInChaos Thank you for your answer. I will check the feistel network. Mar 3, 2016 at 20:05

This is not a block cipher. It is a stream cipher: you are using SHA-512 to generate a one-time pad to encrypt the message.

The security—meaning the attacker's expected cost to break it—is at most $$2^{512}/t$$ if there are $$t$$ users of the system.

How the best possible security of this system relates to the best possible security of a 1024-bit block cipher depends on the block cipher. The idealization of this system—a uniform random 1024-bit pad—has the same security as an ideal 1024-bit block cipher. But a practical block cipher has a key, and it is typically smaller than $$\log_2 2^{1024}! \approx 1024 \cdot 2^{1024}$$ bits long.

In practical terms, you should focus more on everything else about your application's security. For example, you didn't mention authentication, which suggests I can possibly destroy confidentiality by forging messages like EFAIL. There is no point in pushing anything beyond a 256-bit security level, if there was any point going beyond a 128-bit security level in the first place as you get with AES-256-GCM or crypto_secretbox_xsalsa20poly1305.

• s/one-time pad/keystream/ (yes, I know that they're functionally equivalent given the assumption that SHA-512 is a strong PRF, but not from an information theoretic standpoint, however useless in practice).
– forest
Apr 19, 2019 at 1:08
• You're encrypting the message with a one-time pad: $c = m \oplus p$. You're generating the pad with SHA-512. If you authenticate a message with CBC justified by the information-theoretic CBC theorem, but transform the blocks with AES instead of using a uniform random function, is it no longer CBC? If you choose the AES key by a KDF instead of by 256 fair coin tosses, is it no longer AES? If you use Poly1305 with a key chosen by RSA-KEM, is it no longer a one-time MAC? Of course not; that would be a pointless denial of terminology. Apr 19, 2019 at 3:27
• There's no practical or theoretical merit to changing the name of the model when you replace a random variable by a pseudorandom function of a random variable, whether for one-time pads, one-time MACs, CBC, or any other models. Insisting on special status for the term ‘one-time pad’ only encourages people to shoot themselves in the foot by the misapprehension that the pseudorandom function is an evil to be avoided instead of an essential device to make what is fundamentally a very limited idea—$c = m \oplus p$—practically secure. Apr 19, 2019 at 3:43