# Does secure hashing imply secure symmetric encryption?

I was wondering if the mere existence of a (by some definition) secure cryptographic hash function immediately implies an equally secure symmetric encryption scheme.

By my understanding, one could to the following given such a function:

Encryption: Using a shared secret key, we calculate the hash of the key concatenated with the first character of the text, the key concatenated with the first two characters of the text, etc. (every prefix), giving the same number of hashes as characters in the input. This would inflate the size somewhat, but only by a small constant factor.

Decryption: Knowing the key, we can calculate the hash of our key concatenated with every character from the alphabet, and once we find the one that matches the first hash, we can repeat the process with the next hash, until the entire text is found. This would require some more hash calculations than encryption, but only a constant factor, the size of the alphabet (this could be reduced by a bit for bit scheme instead of a character by character scheme).

As far as I know, this incremental series of slightly different inputs to a hash function should not cause the resulting hashes to be predictable, and neither should it leak information about the key.

One weakness I can see is that messages that start out the same and are using the same key will have the beginning of the hash sequence equal up to the point of divergence, but this can easily be mitigated by prefixing the message with a unique ID of some sort, perhaps just a hash of the message itself.

The above is the reasoning that made me think that "hash function" ⇒ "symmetric encryption".

Is there some fundamental principle or scheme that proves/disproves that this is the case?

• With a hash function, you can build a cipher with CTR mode. See Can we use a sort of “hash” function in CTR mode instead of a block cipher? and Is SHA-256 secure as a CTR block cipher? Sep 2 '19 at 14:56
• Sep 2 '19 at 19:34
• Just to point out that the answers given are "yes" to the possibility of a hash based encryption scheme, but not "yes" to the particular encryption scheme you propose. That falls under the general advice of "don't write your own cipher" Sep 2 '19 at 22:54
• Just as a curiosity, you might appreciate this answer where I present an SIV-like misuse resistant authenticated encryption (AEAD) scheme based on nothing but PBKDF2(!), a hash-based construction intended for deriving encryption keys from passwords. (Of course, it can be adapted to use any other PRF with flexible input and output lengths instead.) Sep 3 '19 at 11:46

Once you have PRFs, you have two things. First the classic example of a CPA secure encryption scheme where the ciphertext is $$(r,F_k(r)\oplus m)$$ for a uniformly chosen $$r$$. Second, the PRF itself is also a deterministic message authentication code with canonical verification. Using the encrypt-then-mac construction we can then construct a secure authenticated encryption scheme.