# Can universal hashing functions be (ab)used as stream ciphers?

These days, universal hashing functions like GHASH and Poly1305 are very trendy because of their simplicity and speed.

Now during a discussion related to export restrictions, it came up that mainly encryption techniques are regulated and these hashing functions wouldn't be hit by this.

Now to the question:
Can you run a universal hashing function in CTR mode to get a secure stream cipher?

• My intuition says there's no way to guarantee the security. Generating the keystream via a primitive e.g. AES / ChaCha20 let's us reason about the keystream as the output of a PRP / PRF and we can make some statements about it like the fact that it is computationally indistinguishable from random. On the other hand a universal hash will give us different properties but none of them will let us reason about indistinguishability from random of the keystream, which is essential to a secure stream cipher. That doesn't mean it's not secure, but it does make it hard to prove. – puzzlepalace Oct 20 '16 at 0:20

No. Consider the simple universal hash function $H(k, x) = k \cdot x \in \mathbb{F}_{2^n}$. It is universal as $\text{Pr}[H(k, x) = H(k, y)] \le 1/(2^n - 1)$ for a randomly-selected $k$; polynomial evaluation degenerates to this function when run on a single block. If you run this in counter mode you get as ciphertext $k \cdot 0$, $k \cdot 1$, $\ldots$, which is clearly insecure and leads to immediate key recovery.
And thirdly, if a construction is safe with a certain function $f$, then you can not translate any security property to a generalization of $f$ without a proof. A simple argument for that: Regardless what $f$ is, a generlization would be "just any function $f'$". And that always includes $f'(.) = 0$, which is not useful in almost any case.