I'm reviewing for a computer security exam. Here is a simple scenario:
Suppose that someone suggests the following way to confirm that the two of you are both in possession of the same secret key. You create a random bit stream the length of the key, XOR it with the key, and send it over the channel. Your partner XORs the incoming block with the key, (which should be the same as your key) and sends it back. You check and if what you receive is your original random string, you have verified that your partner has the same secret key, yet neither of you has ever transmitted the key. Is there a flaw in this scheme? Why or Why not?
-because of the XOR, I don't think it is possible to get the same hash from different keys (that would mean it is a bad function...)
Then there is this extension onto the scenario:
You forget about using a key and simply use a random bit stream to XOR with the message and your partner uses the same random bit stream (leveraging the fact that for a given seed, the output of a random number generator is exactly repeatable and completely deterministic.) Is there any possible flaw with this scheme?
-I would say that this breaks one of the fundamental rules of a good hash: it isn't random. Right? I know that it isn't really possible to generate true random values...is that a viable flaw here?