0
$\begingroup$

I wrote a cryptographic function that encrypts a plaintext by using a series of SHA-512 hashes that are used to encrypt the data via a simple byte-to-byte XOR. In order to prevent various attacks, I implemented CBC by hashing the current hash value and the previously enciphered block together. That resulting hash is then used to encipher the next 64-byte block of plaintext via simple XOR. The initial key is a SHA-512 hash of the passphrase or other key. I added several thousand rounds of hashing, and I still need to implement a random 64-byte pad to the front of the code to eliminate some guessing, but as a method is this a sound approach?

I can't imagine it being incredibly insecure, but I am interested in the methods one would use to crack the code.

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ Requests for analyzing ciphertext, finding hash preimages, identifying or decoding some code, or even reviewing full cryptographic designs are off-topic, as the results are rarely useful to anyone else and/or would be too long for this site. $\endgroup$
    – kelalaka
    Apr 20, 2020 at 19:13
  • $\begingroup$ How would decryption work? With most symmetric encryption algorithms, the decryption process is the opposite of the encryption process. If that's the case here, would this mean that all of the SH512 hashes would need to be reversed? $\endgroup$
    – mti2935
    Apr 20, 2020 at 23:51
  • $\begingroup$ Actually, it sounds more like a CFB-like mode, rather than CBC $\endgroup$
    – poncho
    Jan 10, 2021 at 17:40

1 Answer 1

Reset to default
2
$\begingroup$

If the adversary has the plaintext for a block, then the "current hash" can be calculated by simply performing XOR with the ciphertext block at the same position. In that case, every block after that can be decrypted as the "current hash" and the "previously ciphered block" are now known. So the scheme seems to fail for a known plaintext attack, and is thus not IND-CPA secure.

That or "the current hash" has a meaning that you haven't told us about.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.