This question already has an answer here:

I don't have much knowledge about cryptography beyond using libraries for it. So just wanted to understand if the following two cases differ sufficiently in security or is it just psychological:

Say I have a plain text T and I use the following scheme to encrypt:

  1. Take SHA512(T) = H(T)
  2. Use any good symmetric encryption scheme to encrypt T with H(T). Result cipher text = C
  3. Keep H(T) safely secret.

How secure is cipher text C in the wild now ? (I can do (1) a few times if it adds anything - so instead of H(T) use H(H(H(T))) etc. - you get the idea).

How would this compare with using an encryption key unrelated to T ? Since H(T) shouldn't be reversible how much more does an unrelated key add to the security ?


marked as duplicate by CodesInChaos Jul 22 '16 at 15:26

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • $\begingroup$ How are you supposed to decrypt this? (as the intended recipient) $\endgroup$ – SEJPM Jul 22 '16 at 14:18
  • $\begingroup$ Related: Is Convergent Encryption really secure? $\endgroup$ – CodesInChaos Jul 22 '16 at 14:20
  • $\begingroup$ @SEJPM: it's a symmetric cipher - it's not asymmetric. As long as i have the encrypting key i should be able to decrypt it with the same key, should i not ? $\endgroup$ – ustulation Jul 22 '16 at 14:25
  • $\begingroup$ @ustulation, as far as I read this scheme the key for the symmetric encryption is H(T) which is message-dependent. Is your recipient assumed to already know H(T)? $\endgroup$ – SEJPM Jul 22 '16 at 14:33
  • 1
    $\begingroup$ @ustulation The weakness is that if you can guess the data you can confirm that guess without knowing any key. This enables the confirmation attack and the learning the remaining information attack described in the linked question. $\endgroup$ – CodesInChaos Jul 22 '16 at 15:02

These scheme doesn't really make sense in its current form:

  • The key depends on the message. That means, it can not be chosen before the message is chosen. And it is't independent of other parts.
  • How does the recipient receive that key? Or does he learn that from a separate communication channel, after the message (and thus the key) has been chosen? In that case: Why was not the message transmitted instead of the key?

A usual statement is "the key is drawn at random" - and implicitly you can add there " statistically independent from anything else". The reason for this is simple: If a value is calculated based on some other value, then it can be quite difficult to prove that this calculated value does not reveal anything about the original one. Therefore, we just chose a new random value without any dependencies on anything else.

Then, the security of cryptsystems is mostly analyzed with the assumption of a random key. Based on that assumption, statements about security can only be applied if the assumption holds. Having a message-dependent key is far from being random, especially with a deterministic function like a common hash function: If you assume that there are only a very limited amount of possible messages, then there are only a limited amount of possible keys. This makes the assumption invalid. So even if the scheme was known to be secure for random keys, this might not be secure at all.

How would this compare with using an encryption key unrelated to T ? Since H(T) shouldn't be reversible how much more does an unrelated key add to the security ?

Well, no security statement can't be made about your scheme in general. You did not describe what kind of messages you have, how easy they are to guess or just in general, how much entropy you actually got. At worst, this could be completely insecure (example: there are only messages "yes" and "no", everyone can just go through the "encryption" and detect which ciphertext matches which plaintext). At best, you are lucky that the attacker didn't guess your plaintext.

So what is the advantage from a random key? It is huge, because you actually get something where security has been analyzed by lots of people over many years. In cryptography, it is really easy to get things wrong and not even notice it. Also, there is usually no leeway in the definitions unless explicltly stated. If something requires a uniform random key, then both parts are necessary - if you use a key which isn't random (including independence of other things) or isn't chosen uniformly, none of the previous security analysis might apply any more.

  • 1
    $\begingroup$ "Why was not the message transmitted instead of the key?" Perhaps because the key is much smaller than the message? The primary feature of convergent encryption is that it supports deduplication of encrypted data (at a security cost). $\endgroup$ – CodesInChaos Jul 22 '16 at 15:25
  • $\begingroup$ yes the main reason is de-duplication for me too. from that link on convergent encryption, anyone with the locator can get the data but the only one with the key can decrypt it which takes care of anonymity, which is all i care about too. I just needed to know how secure is the encryption itself. $\endgroup$ – ustulation Jul 22 '16 at 15:28

Not the answer you're looking for? Browse other questions tagged or ask your own question.