# Combining keys after key expansion: is it secure?

I've found an algorithm taht performs the following: expand the two keys using cryptographic hashing functions so the final keys will look like nonsense ASCII, then XOR them together to create a single key.

Is this algorithm secure?

Is there any benefit to xor together two keys rather than one with the message?

• It's not clear to me what your encrypting. So far, you've explained: " fk₁ = H(k₁); fk₂ = H(k₂); fk = fk₁ ^ fk₂". Is this correct, or am I missing something? – Aaron Toponce Dec 29 '17 at 22:14
• I'm assuming $c = \operatorname{H}(K_1) \oplus \operatorname{H}(K_2) \oplus p$. If this is not correct, please edit the question. – Maarten Bodewes Dec 29 '17 at 22:23
• Hi Tom, it would be nice of you to react on the comments at the minimum. Please indicate if my answer is missing the point or if it doesn't answer your question fully. – Maarten Bodewes Jan 28 '18 at 23:37
• – e-sushi Feb 27 '18 at 22:59

Well, yes.

The output of the cryptographic hash functions is indistinguishable from random - although not perfectly secure. So if you have $c = \operatorname{H}(K_1) \oplus \operatorname{H}(K_2) \oplus p$ then the result should be dependent on both keys, and you would almost have doubled the key size. This is similar to use two iterations of a block cipher and XOR them together. The XOR function itself should not leak any information about the hash values themselves.

There are however (quite) a few practicalities:

• hash algorithms are sometimes not designed to be resistant to side channel attacks, and hashing keys may leak information about the keys themselves;
• if the keys themselves are not very secure - e.g. relatively short or non-random - then having a hash could be used to distinguish the valid key values;
• key reuse, as in a one time pad, is obviously catastrophical to security.

Using a key derivation function KDF such as HKDF over the concatenation of both key a values and then a trusted cipher would of be a much better way of accomplishing the same level of security, although I would imagine that the scheme in the question is more efficient on restricted platforms. Obviously a cipher has the advantage to be able to encrypt almost any amount of data instead of being restricted to the output size of the hash.

Finally, if the keys are already fully secure, they could be directly used in a one time pad. If the keys are passwords then a password based KDF should be used instead to strengthen the key material before it is used.

• As OP didn't describe how the encryption actually works, one can only hope it doesn't go keyshashresult ^ plaintextblock1, keyshashresult ^ plaintextblock2, …. But I guess that's what you mean with "key reuse, as in one time pad…"? – e-sushi Feb 27 '18 at 23:10