I would like to encrypt a file by XORing the source message with a prng of my own. The prng is streaming a flow of sha512 hashes. Each hash is produced from the previous hash plus constant string plus a password given at the start of encryption ("plus" meaning "concatenated with"). The first million of bytes is skipped before starting encryption.

Is it a safe encryption with regard to state of the art attacks ?

  • 1
    $\begingroup$ You forgot to include integrity checks. So it's not secure against active attackers. $\endgroup$ – CodesInChaos Dec 1 '17 at 11:53
  • 1
    $\begingroup$ You essentially re-invented OFB mode. $\endgroup$ – CodesInChaos Dec 1 '17 at 11:54
  • $\begingroup$ And you're confusing passwords with keys. $\endgroup$ – CodesInChaos Dec 1 '17 at 11:55
  • 2
    $\begingroup$ All the good stuff is in the first 2 million bytes anyway! $\endgroup$ – daniel Dec 1 '17 at 11:57

In general it is possible to make a stream cipher from a secure hash function yes. But to fully evaluate it you should post your full protocol and have it evaluated by the academic community (i.e. not on this site, even though there are a few professors active, it's considered off topic).

One thing that may not be secure is the hashing of the password. For starters you are missing a random salt, so if you use this scheme with the same password then it will fail catastrophically as the key stream will be identical for each encryption.

Furthermore your stream is not authenticated. Authentication of the ciphertext is required to protect it from man-in-the-middle / active attacks (as Codes has already mentioned).

On top of that it is relatively inefficient; there is no need to keep hashing the password, for instance (some other schemes have the same inefficiency, but still it can be avoided e.g. by pre-hashing the password and making sure that the input of the hash fits in a single block).

To create a better scheme, you could use a Password Based Key Derivation Function (PBKDF2, bcrypt, scrypt or Argon2) and an authenticated cipher such as GCM using the result of the PBKDF as key.

If you're dead-bound on using a hash based scheme you could also look at Keyak, which is based on the underlying construction of Keccak / SHA-3. You'd still need a PBKDF of course.

| improve this answer | |
  • $\begingroup$ Thanks for this detailed answer. The password is chosen by the user at encryption time. I need to study your answer before getting back here :) $\endgroup$ – bm842 Dec 1 '17 at 15:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.