As a beginner it seems that a scheme derived from a CSPRNG should be as secure as that CSPRNG. Is this a correct assumption? Are there restrictions or known special cases? A rough outline would be:
- Generate an IV using a non-deterministic CSPRNG.
- Use that IV to seed a deterministic CSPRNG.
- XOR each byte of input with a byte from the d-CSPRNG #2.
- Concatenate(IV, output of #3)
- Use key to seed a deterministic CSPRNG.
- XOR each byte of #4 with a byte from the d-CSPRNG #5
In pseudo-code:
# encrypt
iv = randomBytes(IV_SIZE)
c1 = xorUsingPRNG(plaintext, dCSPRNG(seed = iv))
iv_c1 = iv ++ c1
c2 = xorUsingPRNG(c1, dCSPRNG(seed = key))
# decrypt
iv_c1 = xorUsingPRNG(c2, dCSPRNG(seed = key))
iv = iv_c1[0:IV_SIZE]
c1 = iv_c1[IV_SIZE:]
plaintext = xorUSingPRNG(c1, dCSPRNG(seed = iv))
Both the Key and IV are of reasonable size (meaning they are significantly larger than just a few bits).
Are there any known attacks that would work on such a scheme - under assumption that the CSPRNG used is secure.
If the CSPRNG is secure and produces "random" numbers than the output of (any_data XOR random_numbers) should have the same properties in terms of randomness/distribution for as long as those two are independent.
If the CSPRNG is secure then even if one knows or choses the plaintext it shouldn't be feasible to reconstruct the seed used nor should it be possible to extract the keystream because of the randomization in #3.
Obviously the following doesn't work:
- Seed a d-CSPRNG with the key
- XOR input with output of d-CSPRNG
because this is trivially broken with known/chosen plaintext attacks.