Improving cipher's properties sanity check

I am reading about cryptography I was thinking about these properties of AES (that I use):

1. same message = same ouput
2. no message length secrecy
3. possible insecurity if you know the messages (does this actually apply to AES?)

I hear that AES is secure, but what if I want to theoritcaly improve these properties?

I was thinking I could do this:

1. apply encryption algorithm A
2. XOR with random data D (making sure the output looks random in case of any cipher)
3. generate random data that are longer than the original message
4. use hashing function F to allocate slots in random data (this scrambles the order bytes)

Inputs: Encryption algorith A, Data to XOR with D and a hashing function F

My questions are

• do开发者_如何学JAVAes the proposed solution theoreticaly help with my concerns?
• is this approach used somewhere?

Possible enhancements to this approach

I could also say that the next position chosen by hashing function will be altered using a checksum of the last decoded byte after the XOR step (that way the message has to be decoded from beginning to end)

If I was to use this to have conversation with someone, the data to XOR with could be the last message from the other person, but thats probably a vulnerability.

I am looking forward to your thoughts! (This is only theoretical, I am not in need of more secure encryption, just trying to learn from you guys.)

---

Yeah.

Look. If you want to learn about cryptography, I suggest you read Applied Cryptography. Really, just do it. You will get some nice definitive learnings, and get an understanding of what is appropriate and what is not. It specifically talks about implementation, which is what you are after.

Some rules of thumb:

• Don't make up your own scheme. This is almost universally true. There may be exceptions, but it's fair to say that you should only invent your own scheme if you've thoroughly reviewed all existing schemes and have specific quantifiable reasons for them not being good enough.
• Model your attacker. Find out what scenarios you are intending to protect against, and structure your system so that it works to mitigate the potential attacks.
• Complexity is your enemy. Don't make your system more complex then it needs to be.
• Stay up to date. You can find a few mailing lists related to cryptography and (and hashing) join them. From there you will learn interesting implementation details, and be aware of the latest attacks.

As for specifically addressing your question, well, it's confusing. I don't understand your goal, nor do I understand steps 3 and 4. You might like to take a quick look here to gain an understanding of the different ways you can use a given encryption algorithm.

Hope this helps.

---

You assumptions are incorrect.

1. same message != same output
   The output will not be the same if you encrypt the same message twice.
   This is because you are suppsed to use different IVs'.
2. Message length can be hidden by adding random data to the plaintext.
3. Attacks have been demonstrated against AES with lesser number of rounds. Full-round AES has not been compromised in any way.

Other than that I suggest you follow Noon Silks recommendation and read Applied Cryptography.

---

What's the point of the random data XOR? If it's truly random, how will you ever decrypt it? If you're saying the random data is part of the key, you might as well drop AES and use only the truly random key - as long as it's the same length (or longer than) the data and is never used more than once to encrypt. It's called a one-time pad, the only theoretically unbreakable encryption algorithm I know about.

If the random bits are pseudo-randomly generated, it's highly unlikely that your efforts will yield added security. Consider how many talented mathematicians were involved in designing AES...

EDIT: And I too highly recommend Applied Cryptography, it's an actually very readable and interesting book, not as dry as it may sound.