I know this isn't the best practice, but what if I took a cheap/fast 128-bit stream cipher (assuming both the key and the stream blocks are 128 bits) and mixed in the plainkey with the plaintext (let's say the 128-bit key appears about once within every ten 128-bit blocks, but at otherwise random positions to prevent a MITM attacker who knows the plaintext from faking a message without being noticed)?

This is just a crude straightforward way of tamper-proofing a stream. Don't worry, I won't actually do this, but I'd like to know if it's been proven to leak the key for some common stream cipher. This previous question touches on the risk but does not get into specifics.

So, are there any commonly used stream ciphers which have known security vulnerabilities if I did this? What about slower block ciphers converted to stream ciphers like ChaCha? What about slow and already-authenticated stream ciphers (just because I'm curious about how loose I can be with the key before encryption) like AES-GCM?

Of course, if you tell me there's a problem with encrypting the key itself using the same key, I guess I could just encrypt some hash of the key...as I understand it, that's basically the MAC we often use.

  • $\begingroup$ Is there any reason why you can't use a MAC? $\endgroup$ Commented Jan 5, 2020 at 5:57
  • $\begingroup$ ChaCha is not a block cipher converted to a stream cipher just because it has a counter. $\endgroup$
    – forest
    Commented Jan 5, 2020 at 9:37
  • $\begingroup$ @YehudaLindell This is not an engineering question like I tried to point out, it's simply a curiosity. And, sorry for the semantics, but I'd say the core of ChaCha has more of a block cipher which gives it the benefit of random access but makes it slower than simpler constructions like Rabbit. $\endgroup$
    – bobuhito
    Commented Jan 5, 2020 at 12:26
  • $\begingroup$ The core of ChaCha acts more like a hash function than it does like a block cipher. $\endgroup$ Commented Jan 5, 2020 at 22:42
  • $\begingroup$ @bobuhito Stream ciphers that generate keystream output in discrete blocks (as opposed to continuously generating output statefully like RC4, ISAAC, or Rabbit) are still stream ciphers. The core of ChaCha is a hash-like random function, itself built out of a public permutation that is XORed with the state to prevent inversion. A block cipher is a completely different concept, where one of $2^n!$ possible permutations (for an $n$-bit block) is selected at random based on a key. ChaCha, despite using a counter, is a stream cipher. $\endgroup$
    – forest
    Commented Jan 6, 2020 at 7:17


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.