I was just wondering why this kind of algorithm can't be used instead of, say, Diffie-Hellman to exchange keys:
- Alice decides on a key she wishes to share with Bob.
- Alice generates a stream of bytes with the same length as the key (securely, say, with a CSPRNG).
- Alice sends to Bob:
C1 = (key ^ alice_random_bytes)
- Bob generates a stream of random bytes in a manner similar to Alice.
- Bob returns to Alice:
C2 = (C1 ^ bob_random_bytes)
- Alice XORs
C2with her random byte sequence again, leaving only
key ^ bob_random_byteslike so and sends it to Bob:
C3 = (C2 ^ alice_random_bytes) = (C1 ^ bob_random_bytes ^ alice_random_bytes) = (key ^ alice_random_bytes ^ bob_random_bytes ^ alice_random_bytes) = (key ^ bob_random_bytes)
- Bob XORs
C3with his random bytes and obtains the key:
K = (C3 ^ bob_random_bytes) = (key ^ bob_random_bytes ^ bob_random_bytes) = key
This seems a lot simpler than Diffie Hellman, so I was wondering: what is the issue with such an algorithm?