These days, universal hashing functions like GHASH and Poly1305 are very trendy because of their simplicity and speed.

Now during a discussion related to export restrictions, it came up that mainly encryption techniques are regulated and these hashing functions wouldn't be hit by this.

Now to the question:
Can you run a universal hashing function in CTR mode to get a secure stream cipher?

  • $\begingroup$ My intuition says there's no way to guarantee the security. Generating the keystream via a primitive e.g. AES / ChaCha20 let's us reason about the keystream as the output of a PRP / PRF and we can make some statements about it like the fact that it is computationally indistinguishable from random. On the other hand a universal hash will give us different properties but none of them will let us reason about indistinguishability from random of the keystream, which is essential to a secure stream cipher. That doesn't mean it's not secure, but it does make it hard to prove. $\endgroup$ Oct 20, 2016 at 0:20

2 Answers 2


No. Consider the simple universal hash function $H(k, x) = k \cdot x \in \mathbb{F}_{2^n}$. It is universal as $\text{Pr}[H(k, x) = H(k, y)] \le 1/(2^n - 1)$ for a randomly-selected $k$; polynomial evaluation degenerates to this function when run on a single block. If you run this in counter mode you get as ciphertext $k \cdot 0$, $k \cdot 1$, $\ldots$, which is clearly insecure and leads to immediate key recovery.

Universal hash functions (or the weaker almost-xor-universal variants) work with authentication because their sole job is to uniformly map a potentially long message to a shorter one; the secrecy job is handled by some PRF or PRP.


You're mixing up various concepts of security, and that - in general - just doesn't work.

First, universal hashing on its own does not have any security property. Universal hashing is used in some constructions, for example UMAC.

Secondly, you used the term GHASH, which is an internal function of GMAC or GCM. The security property holds for the entire construction, and you can't just take one part of it. Then you use that next to Poly1305, which is in fact a MAC, so it's quite unclear what you actually meant. And then you call them hash universal hash functions, which is again something different than a MAC.

And thirdly, if a construction is safe with a certain function $f$, then you can not translate any security property to a generalization of $f$ without a proof. A simple argument for that: Regardless what $f$ is, a generlization would be "just any function $f'$". And that always includes $f'(.) = 0$, which is not useful in almost any case.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.