I've come up with a way to transform a stream of bytes such that if any single bit is modified, it cannot be transformed back into its original state. Here's how it works:


  • Get hash of entire file (call it hash A)
  • XOR file using repeat concatenations of hash A
  • Get hash of XOR'd file (call it hash B)
  • XOR hash A using hash B (call it key)
  • Put key at beginning of file


  • Hash file excluding key (we get hash B)
  • XOR key using hash B (we get hash A)
  • XOR file excluding key with hash A
  • File is good if its hash matches hash A

I've made a working implementation of this here, using sha1 as the hash function.

Edit: found out they're called All-or-nothing transforms.

My use case

I'm planning a peer-to-peer social networking system where users are authenticated using a conventional username/password combo. One method I can think of is to generate a private/public keypair, encode the private key with an AONT, split it up into pieces, and give an ID to each piece using some hash or PRNG output seeded by the username and password.

The pieces will then be distributed to random peers. Since each peer gets an incomplete part of the encoded file, it should not be readable. The peers would not know where the other pieces are, so the only way to reconstruct the file should be by getting all the pieces by generating the same IDs using the same username/password combo and requesting it from the network.

Somewhat like IPFS, where files are identified by its hash, each piece of the encoded file will only be accessible by its ID, which can only be acquired by seeding the PRNG with the correct username/password combo.


  1. Is my encoding method right? Did I miss anything that would cause the encoded file to be (partially) decoded when the complete file isn't accessible?
  2. Is there anything I could modify to improve it?
  3. Is my use case approach to storing private info correct?

Thanks in advance!

  • $\begingroup$ What security property are you trying to achieve? What kind of attack are you trying to prevent? Right now, since the construction has no secret randomness, it probably can't provide any security guarantee. $\endgroup$ – Mikero Mar 29 '19 at 5:39
  • $\begingroup$ @Mikero I'm trying to store some data in a zero-trust network in a way that no node can read what they're storing, or who stored them. The only way to read the file is to know the PRNG seed and generate a few strings, which will be used to fetch the pieces from the network and assemble them again. The contents could be encrypted with another container before being distributed. I'm trying to prevent other people from being able to read the contents of what they're storing without having all the pieces together in the right order. $\endgroup$ – HizkiFW Mar 29 '19 at 5:51
  • 1
    $\begingroup$ "only way to read the file is to know the PRNG seed" --> this seems to be totally independent of the hash/xor thing you described. "I'm trying to prevent other people from being able to read the contents of what they're storing without having all the pieces together" --> secret sharing? In any case, you didn't mention anything involving "integrity" (resilience to someone tampering with data), only confidentiality (unauthorized people can't see the data). $\endgroup$ – Mikero Mar 29 '19 at 6:11
  • $\begingroup$ @Mikero Yeah the PRNG is another independent system. It's like secret sharing, but none of the participants know who the other participants are. The participants are assigned the shares of the secret by the PRNG. Is that security by obscurity or considered secure enough that no participant can construct the secret without the PRNG seed? $\endgroup$ – HizkiFW Mar 29 '19 at 6:31
  • $\begingroup$ There's a much easier way. First, encrypt normally. Then hash the ciphertext, use that hash as a key encryption key for the file encryption key. Then you encrypt that with the user key (password derived key or whether else), and then you can append this double encrypted key to the ciphertext. You can then only decrypt the file by knowing both the password and full ciphertext plus encrypted key. $\endgroup$ – Natanael Mar 30 '19 at 1:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.