SHAKE256_XOF is an extendable output function based on SHA3-512. SHAKE256_XOF can be used to create an infinite length bit string with 256-bits of security. For example:
from Crypto.Hash.SHAKE256 import SHAKE256_XOF shake = SHAKE256_XOF() shake.update(b'key' + b'nonce') for _ in range(10): print(shake.read(16).hex())
18068a140f4c0f1f85f17da13b049155 1fc6d25b11833480dae5fba50b8b73db bf4284c0d9a32b9b374ae82d5c0514c6 ...
SHAKE256_XOF is a pseudorandom function so XOR-ing its output with a plaintext should produce a ciphertext. My understanding is that this would be an asymmetric stream cipher. I am having a hard time finding research on this other than it being possible and Bruce Schneier saying "I know of no cryptanalytic analysis of particular one-way hash functions as block ciphers; wait for such analysis before you trust any of them." Finally, this cipher can be made authenticated by SHA3-512 as part of the seed. This leads to the final algorithm:
from Crypto.Hash.SHAKE256 import SHAKE256_XOF from Crypto.Hash import SHA3_512 xor = lambda lhs, rhs: bytes(a ^ b for a, b in zip(lhs, rhs)) plaintext = b'plaintext' key = b'key' nonce = b'nonce' digest = SHA3_512.new().update(plaintext).digest() e_shake = SHAKE256_XOF().update(key + nonce + digest) cipher_text = xor(e_shake.read(len(plaintext)), plaintext) d_shake = SHAKE256_XOF().update(key + nonce + digest) d_plaintext = xor(d_shake.read(len(cipher_text)), cipher_text) print(d_plaintext)
- Is there any literature on using SHAKE256_XOF as a cipher?
- How does this method compare to AES256 in terms of security?
- What are there weaknesses or disadvantages of this cipher? Obviously, the use of SHA3-512 to make it authenticated means it can't be efficiently encrypted in one pass, and decrypting requires calculating the SHA3-512 digest to authenticate (I am learning how authenticated encryption works so suggestions and feedback are welcomed).
- Does it provide any possible advantage over AES256?
- AES256 has 128-bit resistance against theoretical quantum attacks. Would this cipher maintain the
min(key_length/2, 256)bits of resistance to theoretical quantum attacks that SHAKE256_XOF has.