# Security of a sha-256 based stream xor cipher?

Provided that I have some data I want to cipher and a password to do it:

1. I generate a random IV
2. I define c = sha256(password)
3. I generate an infinite stream where x0 = sha256(IV xor c) and xi = sha256(xi-1 xor c). This produces blocks of 32 bytes and I yield them byte by byte
4. output = data xor stream

Would this be secure? In case it's not, how insecure is it?

Note: The NSA isn't going to crack it, I just need it to be secure for a user with average-high cryptographic knowledge.

I know it may look similar to Is it feasible to build a stream cipher from a cryptographic hash function? but it has some differences:

• I use a random IV instead of starting with hash(data)
• Im xoring c in each phase of the stream generator, so even knowing xi you can't guess xi+1
• Don’t use sha256(password) as that’s the first part (of many) where your idea goes downhill. SHA-256 is not a Password-Based Key Derivation Function. Using a weak password would end in disaster, no matter if you wrap it in SHA-256 or not. I‘ll leave the rest up to others to explain in actual answers. Btw. there are some related Q&As you might want to check: Building a stream-cipher out of a hash function? and Can I construct a feasible stream cipher out of HMAC and a secure hash algorithm? Dec 16 '17 at 19:28
• As Yadkee notes, this is actually a slightly different construction from all three linked—which are all, incidentally, different from the stream cipher I would recommend if you absolutely had to build one out of SHA-256, which is the ‘CTR mode’ $\operatorname{SHA-256}(k \mathbin\Vert \operatorname{le64enc}(0)) \mathbin\Vert \operatorname{SHA-256}(k \mathbin\Vert \operatorname{le64enc}(1)) \mathbin\Vert \cdots$, maybe with a nonce. None of this changes the substance of my answer, of course, which is that to build a stream cipher out of SHA-256 for your application is to meow up the wrong tree. Dec 16 '17 at 22:29