🚀 go-pugleaf

In article <1992Nov2.200735.15588@mlb.semi.harris.com> mvm@epg.harris.com (Matt Mahoney) writes:
>Supposed I generate a pseudo-random number sequence R using a secure
>one-way hash function (such as MD5) by:
>
>    r[i+1] = MD5(r[i] XOR password)
>
>and my encryption (and decryption) algorithm is:
>
>    ciphertext = plaintext XOR R 
>
>Is this secure?

Yes, but.

It's known as output feedback (OFB) mode, and yes it is secure, *but*...
unless you take precautions, an active eavesdropper can still
meaningfully alter the message.  Let's say you use this to connect
an ATM with a central bank computer.  The underlying message
formats are known.  An active wiretap can invert the bit corresponding
to some large number of dollars and thereby alter the transaction
in its owner's favour, by turning $50 into $50+$1024, for example.

A checksum will help, but a standard CRC will *not*, as it is trivial
to fix that up by toggling the bits that would indicate the error
caused by toggling the $1024 bit.

Or if the eavesdropper ever gets all of the plaintext, they can extract
the pseudo-one-time pad by xor, and send an arbitrary message in its place.

So be careful.
-- 
	-Colin