There are 2 computers who are going to exchange lots of small packets of data between each other. To generate a shared secret, an elliptic key exchange takes place. If this key is hashed with the current time, and the data is then encrypted with this key via a one time pad cipher algorithm, and then the time is sent with the encrypted data so the other computer can create the same key to decrypt the one time pad cipher, is their any security vulnerabilities??

The key and data would be like so (for encryption):

SharedSecret genreated from elliptic curve key exchange Key = Hash(SharedSecret + Time) Message = OneTimePadCipher(packet data, key) + Time

Are there any vulnerabilities with reusing the same elliptic curve shared secret with a different time in the hash algorithm to create a one time pad key??

  • 2
    $\begingroup$ Why is there a one-time-pad here? Once you exchanged the keys, use Authenticated Encryption modes like AES-GCM or ChaCha-Poly1305. $\endgroup$ – kelalaka Aug 17 at 19:25
  • 1
    $\begingroup$ You don't get any forward secrecy (access to the key reveals all secrets). If your clock is bad or can be manipulated, repetitions might happen = security break. Also, this is technically a stream cipher construction since you reuse a seed to derive randomness. $\endgroup$ – Natanael Aug 17 at 20:05
  • $\begingroup$ A large enough random salt would be a better idea than the time. You could use this as input of e.g. HKDF, a hash based key derivation function. However, even then, a stream cipher and a nonce (e.g. message number) might be a better idea. I'd then also make sure that each computer has a sending and receiving key, so there cannot be any overlap between the nonces. $\endgroup$ – Maarten Bodewes Aug 18 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.