Near as I can tell (no expert mind you) it seems right. Given that SHA is secure (cannot calculate a plaintext that will result in the same SHA result) then onl

Near as I can tell (no expert mind you) it seems right. Given that SHA is secure (cannot calculate a plaintext that will result in the same SHA result) then only the original text could have reasonably generated it. Sending the SHA result to your friend does not help him in determining your original plaintext. Only with random text can he determine the plaintext that generated the SHA result. Seems good enough.