What makes HMAC-SHA256 a bad cipher?

What is the name of the property that HMAC-SHA256 lacks that prevents
us from using it as cipher? More specifically why shouldnt someone
use

HMAC-SHA256-CTR = XOR(HMAC-SHA256(nonce || counter, Key), plaintext)

[to simplify, assume that the size of the plaintext = 128b and the
nonce and an independent MAC are also appended to ciphertext as
usual.]

To be more specific, If both AES-256-CTR and HMAC-SHA256-CTR are
assumed to be PRF, which quality of the PRF will you say is better in
AES-256-CTR?

Second question is if a protocol uses SHA256 (say for HMAC), what good
does it do to use AES256 as well since the protocol's weakness will be
SHA256

[to simplify, assume that the number of shared key operations are the
same]

Thanks
-han
.

Relevant Pages

  • Re: Encyption of two 256-blocks
    ... for round i) as the PRF. ... This is a 256-bit block cipher. ... same thing with this to get a 512-bit block cipher. ... how many rounds is actually enough? ...
    (sci.crypt)
  • Re: Is RC4 a good choice?
    ... such as a Stream Cipher. ... A `pseudorandom permutation', or `PRP', is a family of permutations over ... difference, then, between a PRP and a PRF is that a PRP is invertable. ... A block cipher attempts to be a PRP. ...
    (sci.crypt)
Quantcast