Enhanced Diffusion Through Key-Selected Hashing

Source: Dev.to

Overview

To achieve complete diffusion in the metaclass encryption architecture, the system can implement key‑driven hash algorithm selection.
The key itself determines which hashing algorithm is used for parameter derivation, adding another layer to the infinite algorithm space.

Primary Hash Candidates

All candidates are cryptographically secure, so no custom hash implementations are required.

Key Processing Flow

1. Extract the first few bits from the key.
2. Determine which hash algorithm to use based on those bits.
3. Hash the remaining key with the selected algorithm.
4. Generate all encryption parameters from the hash output.

Example

Key: "mySecretKey123xyz"
First 3 bits: 101 → selects SHA‑512
SHA‑512("mySecretKey123xyz") → generates modulus, exponent, maps …

Changing a single bit can:

• Switch the hash algorithm itself.
• Produce a completely different hash output.
• Result in maximal variation of derived parameters (avalanche effect).

Algorithm Diversity

• Two similar keys may invoke different hash functions (e.g., SHA‑256 vs. BLAKE2b).
• This adds a multiplicative layer to the already infinite algorithm space.

Cryptographic Strength

• All listed hash functions provide strong diffusion.
• No extra secrets beyond the key are needed.

Performance Flexibility

Speed (approximate, platform‑dependent):

• BLAKE2b: ~3.3 GB/s (fastest on 64‑bit)
• BLAKE2s: ~2.5 GB/s (fastest on 32‑bit)
• SHA‑256 / SHA‑224: ~500 MB/s
• SHA‑512 / SHA‑384: ~650 MB/s (faster than SHA‑256 on 64‑bit)

Keys can naturally select faster algorithms when performance matters, or slower, more compatible ones otherwise.

Integration with Existing Framework

Before:

Key → SHA‑256 → Parameters → Algorithm

With Hash Selection:

Key → [Key selects hash] → Selected Hash → Parameters → Algorithm

The key now controls:

• Which hash algorithm processes it.
• Which map‑generation method to use.
• Which representation strategy to apply.
• Which modulus patterns to follow.
• Which transformation rules to implement.

Each layer multiplies the possibilities:

[ \infty_1 \times \infty_2 \times \infty_3 \times \infty_4 \times \infty_5 \dots ]

Hash Selection Methods

Method 1 – Direct Bit Mapping

Method 2 – Derived Selection

selector = (sum of first N bytes) mod 6
0 → SHA‑224
1 → SHA‑256
2 → SHA‑384
3 → SHA‑512
4 → BLAKE2s
5 → BLAKE2b

Method 3 – Key‑Length Based

Threat Model

For Attackers

1. Guess the key.
2. Determine which hash algorithm was used.
3. Reverse‑engineer the hash‑generated parameters.
4. Identify the generated encryption algorithm.
5. Decrypt the ciphertext.

Each step multiplies the search space (∞ × 6 × ∞ × ∞ × ∞ …).

For Legitimate Users

• The key deterministically selects the same hash.
• The hash deterministically generates the same parameters.
• Decryption follows the identical path—no extra secrets required.

Sample Implementation (Python)

import hashlib

def derive_parameters(key: str):
    """
    Derive encryption parameters from a key using key‑driven hash selection.
    """
    # 1️⃣ Choose hash algorithm (simple selector: first byte % 6)
    selector = key.encode()[0] % 6
    hash_algorithms = [
        hashlib.sha224,
        hashlib.sha256,
        hashlib.sha384,
        hashlib.sha512,
        hashlib.blake2s,
        hashlib.blake2b,
    ]
    selected_hash = hash_algorithms[selector]

    # 2️⃣ Hash the key
    key_hash = selected_hash(key.encode()).digest()

    # 3️⃣ Derive parameters from the hash output
    modulus   = int.from_bytes(key_hash[:8],  'big') % (10**12)
    exponent  = int.from_bytes(key_hash[8:10], 'big') % 7 + 3
    map_seed  = int.from_bytes(key_hash[10:], 'big')

    return modulus, exponent, map_seed, selected_hash.__name__

Comparison with Traditional Approach

Overall Impact

• Full diffusion while adding a multiplicative layer to the metaclass architecture.
• Uses only established, trusted cryptographic hashes.
• Requires no additional secrets beyond the key.
• Adds minimal computational overhead.
• Seamlessly integrates with the existing framework.
• Expands the algorithm space by another factor.

Series Information

Part of the Metaclass Encryption Architecture Series

Author: Muhammed Shafin P (@hejhdiss)
License: CC BY‑SA 4.0 – an open‑source concept.

Community contributions are welcome!