0
$\begingroup$

I want to encrypt a list of unique values and I want the property of when I encrypt the same value I get the same ciphertext (determinism). The adversary only observes the ciphertexts of a unique set of plaintext values. In this context would the following encryption algorithm be secure:

  1. I generate the sha256 hash of the plaintext value
  2. I use the hash as the IV to AES-GCM to encrypt the plaintext value

Is the resulting ciphertext which includes the hash of the plaintext value secure?

$\endgroup$
2
$\begingroup$

No, because in order to decrypt it you must pass along the SHA-256 hash too, and now you have leaked a public function of the original message, which an adversary can use to efficiently test a guess offline about what the original message was.

If you want a deterministic authenticated cipher, you might consider an existing construction like SIV that has been studied already.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.