4

These days, universal hashing functions like GHASH and Poly1305 are very trendy because of their simplicity and speed.

Now during a discussion related to export restrictions, it came up that mainly encryption techniques are regulated and these hashing functions wouldn't be hit by this.

Now to the question:
Can you run a universal hashing function in CTR mode to get a secure stream cipher?

SEJPM
  • 46,697
  • 9
  • 103
  • 214

2 Answers2

6

No. Consider the simple universal hash function $H(k, x) = k \cdot x \in \mathbb{F}_{2^n}$. It is universal as $\text{Pr}[H(k, x) = H(k, y)] \le 1/(2^n - 1)$ for a randomly-selected $k$; polynomial evaluation degenerates to this function when run on a single block. If you run this in counter mode you get as ciphertext $k \cdot 0$, $k \cdot 1$, $\ldots$, which is clearly insecure and leads to immediate key recovery.

Universal hash functions (or the weaker almost-xor-universal variants) work with authentication because their sole job is to uniformly map a potentially long message to a shorter one; the secrecy job is handled by some PRF or PRP.

Samuel Neves
  • 12,960
  • 46
  • 54
3

You're mixing up various concepts of security, and that - in general - just doesn't work.

First, universal hashing on its own does not have any security property. Universal hashing is used in some constructions, for example UMAC.

Secondly, you used the term GHASH, which is an internal function of GMAC or GCM. The security property holds for the entire construction, and you can't just take one part of it. Then you use that next to Poly1305, which is in fact a MAC, so it's quite unclear what you actually meant. And then you call them hash universal hash functions, which is again something different than a MAC.

And thirdly, if a construction is safe with a certain function $f$, then you can not translate any security property to a generalization of $f$ without a proof. A simple argument for that: Regardless what $f$ is, a generlization would be "just any function $f'$". And that always includes $f'(.) = 0$, which is not useful in almost any case.

tylo
  • 12,864
  • 26
  • 40