Assuming that:

  • SHA-256 and SHA-512 are random and irreversible
  • the output appended to some random and long enough secret is just as random as any other data and will produce values that are just as hard to guess

Then one can conclude that a cipher can be constructed using those hash functions in the following manner:

  • let state and key both be 32 or 64 byte values
  • initialize state with a random IV and key with a random key
  • make v equal the hash of state + key, xor block of plaintext withv
  • update state with the cipher produced
  • repeat until all plaintext is processed
  • to decrypt do the same, but update the state with the cipher text

Now the question is, does such a cipher exist? Is it possible to discover the plaintext given a ciphertext without brute-forcing the key? If so, what techniques could be used for that?


This would appear to be CFB mode, only using a hash function (with a secret key as part of the input), rather than a block cipher.

As such, assuming that the hash function with the partially secret input acts as a random Oracle, this provides privacy. However, it doesn't provide integrity (that is, the attacker can modify the ciphertext, and the resulting ciphertext will decrypt, and in fact produce semipredictable changes to the plaintext), and will probably end up being slower than a more conventional encryption method.

  • $\begingroup$ I tested using SHA-512 and got 160MB/s on my i7-2600 vs 87MB/s from AES-256-CBC, for 64 byte blocks, a 512-bit state and 256-bit key. so the speed is not only not worse, but much better. $\endgroup$
    – Douglas
    Sep 24 '16 at 18:43
  • $\begingroup$ @ultra: if you get only 87MB/s from AES, then either you have a massively inferior AES implementation (or you made a mistake taking the measurement) $\endgroup$
    – poncho
    Sep 24 '16 at 19:03
  • $\begingroup$ I checked using openssl speed aes, the screenshot: imgur.com/enh3VeC $\endgroup$
    – Douglas
    Sep 24 '16 at 20:30
  • $\begingroup$ @ultra I implemented this also, using SHA256, and it seemed to be about 30% slower than AES on average. I didn't test much above 1MB though. $\endgroup$
    – Luke Park
    Sep 26 '16 at 22:30
  • $\begingroup$ @LukePark I tried both and only got 65MB/s with SHA256 vs 160MB/s with SHA512. $\endgroup$
    – Douglas
    Sep 26 '16 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.