Could a hash function like sha1 or ripemd-160 be used for secure key generation in a stream/block cipher? Obviously a repeated key like "abc123abc123abc123" would be bad, and a one time key pad would be impractical for large data... but what if one used a hash function to derive new keys from the origional password like:


$password = "secure password here!";
$round =0;
$key = sha1($password . $round);
$result .= XOR($data,$key);

Not that i am going to use this for anything, but just curious, what would be secure/insecure about this method... thanks...

1 Answer 1


There are definitely problems with this scheme. First, it seems to be deterministic -- every time you encrypt a new stream with the same password it starts with $round=0. Thus your stream is like a one-time-pad that's being used repeatedly -- the many time pad which is easily attackable by XORing encrypted streams together and exploiting patterns in underlying plaintext. Granted, this could be easily fixed by doing something like $round = generate_random_80_bit_number() and then appending this 80-bit number to the start of your ciphertext.

I'm somewhat worried about the cryptographic hash functions being based on a Merkle-Damgard construction which are susceptible to extension attacks. The reason HMAC isn't H(K ++ m), but H(K1 ++ H(K2 ++ m)). I haven't fully worked out the details on how to exploit your scheme having sequential round numbers, but could imagine attacks on the MD construction and using sequential rounds appended to the end of a common prefix.

  • True, the round always start with zero, but given that a hash function is used, any change in the password used per encryption will result in a very different key being used per round... I would also trust a good block cipher more than a hash function, I was just curious whether i was overlooking any obvious security issues... I agree that the deterministic aspect of deriving keys using a counter is a weakness... Commented May 17, 2014 at 18:58
  • @DanielValland - I think its fair to assume if anyone ever deployed this scheme and could say use it to encrypt files or messages, they may apply it multiple times and having a random nonce/IV is very much necessary in that scenario. I've expanded my thoughts on why the MD construction is bad. I still haven't fully worked it out but gave a basic outline of how it would be attackable. Using a different type of hash like Keccak (based on sponge construction) wouldn't be vulnerable in this way, but again using a well-vetted block cipher seems a much better idea.
    – dr jimbob
    Commented May 17, 2014 at 19:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .