2

I've read that the Whirlpool hash function can produce footprints that could be used as a pseudorandom generator.

Is it "OK" to use it to encrypt some data using something like the following?

EncryptedData = Concat(DataBlock XOR Whirlpool(DataBlock + SecretKey))
e-sushi
  • 17,891
  • 12
  • 83
  • 229
fbparis
  • 123
  • 3
  • 2
    Strong, fast, and well-studied encryption algorithms like AES-GCM exist. Why consider something like this in the first place? – Stephen Touset Sep 22 '13 at 07:03
  • Your specific mode looks crazy. At best it's similar to ECB, which is a very weak block cipher mode. Your construction is actually fatally broken for some hashfunctions, since the DataBlock XOR hash step might interfere with their feed-forward operation. – CodesInChaos Sep 23 '13 at 11:39
  • Your operation can't be decrypted in the first place. So it's not even encryption. – CodesInChaos Sep 23 '13 at 11:53

3 Answers3

4

Occasionally, for instance in very constrained environment, it can be useful to use only a few cryptographic primitives for all processing. (When you only have a hammer everything looks like a nail.)

In such environments, it may be useful to use key derivation function to derive stream to be used as a stream cipher, or use hash function as cipher and so on.

However, using primitives in non-standard ways risks implementation mistakes and often is "path less traveled", thus risking vulnerabilities that were not thought of.

EncryptedData = Concat(DataBlock XOR Whirlpool(DataBlock + SecretKey))

Have you thought of decrypting data encrypted this way? The DataBlock is supposedly to be kept as a secret, but Whirlpool takes it as input. Thus, to decrypt EncryptedData, it is necessary to know DataBlock.

A pretty well examines way of using hash function based on cipher function as cipher is SHACAL-2. SHACAL(-2) is one of the most well examined "hash-function turned into cipher" constructs. It has been used with SHA-1 and SHA-2 hash functions. It would be possible to use similar construct to turn (some implementations of) Whirlpool into a forward cipher function, and then use that in, in counter mode.

If it is mandatory to use entire Whirlpool function (above "WhirlpoolCAL" construct would not use padding part of hash function), then you could, for instance, use key derivation construct as stream cipher. See NIST SP 800-108 Recommendation for Key Derivation Functions using Pseudorandom Functions. The document shows a few ways that could be used to construct keys stream using a hash function (approved hash functions are SHA family, but here you would use Whirlpool). Note the NIST SP 800-108 requires HMAC construct to build keyed hash function from hash function.

That document also warns against idea of using the function as stream cipher: "To comply with this Recommendation, the derived keying material shall not be used as a key stream for a stream cipher2. 2 The level of security provided by using the key derivation functions specified in this Recommendation to generate a key stream for stream ciphers has not been investigated."

So summary is, that you "could" do it like this:

EncryptedData = Data XOR KDF(HMAC(Whirlpool))

Where KDF is implemented using the following process (see the above mentioned document SP800-108 for full details).

Process:

  1. n := ⎡L/h⎤.
  2. If n > 2r-1, then indicate an error and stop.
  3. result(0):= ∅.
  4. For i = 1 to n, do
    a. K(i) := PRF (KI, [i]2 || Label || 0x00 || Context || [L]2) 12
    b. result(i) := result(i-1) || K(i).
  5. Return: KO := the leftmost L bits of result(n).

But: The comment above from Stephen Touset, the SP 800-108 document, and this answer also, are all warning against doing it this way. Use good cipher like AES (or maybe Camellia or ARIA or whatever) in appropriate mode for symmetric encryption and decryption needs and avoid home-baked cryptography.

(AES-CTR if you want to use XOR and no message integrity. AES-GCM is typically even better idea.)

e-sushi
  • 17,891
  • 12
  • 83
  • 229
user4982
  • 5,319
  • 20
  • 32
0

Alternative, you can use Whirlpool-HMAC in place of block cipher encryption in OFB, CFB or CTR modes. That gives you an stream cipher.

Maxthon Chan
  • 558
  • 3
  • 12
  • But of course HMAC causes another factor 2 slowdown of an already slow construction. – CodesInChaos Sep 23 '13 at 11:58
  • Another alternative is to use NIST SP 800-90A Hash_DRBG with Whirlpool (instead of approved cipher). The output of that pseudo random number generator theoretically could be used as keystream. But, it is better use appropriate encryption standards. – user4982 Sep 23 '13 at 15:03
0

Here is a big idea, assuming the only algorithm you have in your crypto system is Whirlpool (or any hash algorithm like SHA-512):

First you can construct a one-way compression function by constructing a HMAC.

With that function, you can run it in CFB, OFB or CTR modes, which gives you a good CSPRNG that can both serve as a stream cipher keystream and a block cipher key schedule.

Finally you can construct a block cipher by running the function in Feistel network and use that key schedule.

Maxthon Chan
  • 558
  • 3
  • 12
  • Or you could simple undo the feed-forward. That way you directly get a block-cipher. No need for a Feistel network. – CodesInChaos Sep 26 '13 at 14:51