Could we share a secret key using the Birthday problem? I stumbled upon this code on-line, it seems obvious to me that generating all 2^40 keys in trivial time can always be achieved as can hashing each and everyone of them, using the SHARED Salt that "Eve" could easily see:

### Here we outline:
### Sharing a SINGLE FOURTY BIT secret block, using the birthday problem (Proof Of Concept)

Alice (transmit):
MAKE SALT1
SEND SALT1 to Bob
Listen Until:
RECEIVE SALT2 from Bob
Let x = 2^18 (262,144)
Repeat x times:
Generate random 40 bits, call them Kx
Hash(Kx|SALT1) to make Hx
  Tranmit: SEND ALL Hx Values
WAIT FOR BOB'S RESPONSE
If response is:
  (no match found, try again) --&gt; Go back to start
  (maybe match found, Hx, DATA) // If HASH(Kx|SALT2) = DATA, then common key found
  (if still no match found, try again) --&gt; Go back to start
If common key found, respond: "FOUND"|HASH(Kx|SALT2) to Bob to complete confirmation

####################################################################################

Bob (recieve):
MAKE SALT2
SEND SALT2 to Alice
Listen Until:
RECEIVE SALT1 from Alice
Let x = 2^18 (262,144)
Repeat x times:
Generate random 40 bits, call them Kx
Hash(Kx|SALT1) to make Hx
  Wait for: RECEIVE ALL Hx Values
LOOK FOR the first matching calculated and received Hx, if any match
RESPOND EITHER:
       (maybe match found, Hx, HASH(Kx|SALT2) // where multiple matches are found, we use the first match
OR:
       (no match found, try again)
WAIT FOR RESPONSE
  if response reads "FOUND"|{checkable data} then common key found
  if response reads as SALT1, then go back to start


Does this have any practical applications whatsoever? What if the author had suggested that from each 40-bit secret, we use some to produce a salt for verifying Bob and Alice are still talking. Does this "protocol" have any use? Can anyone link where in Bruce Schneier's Applied Cryptography, something like this comes up? It looks familiar but I don't see how it's practical.
You are right that if it costs Alice &amp; Bob effort $N$ to agree on a key in this way, then it costs Eve only effort $N^2$ to find it. So the protocol is not secure in the standard sense, and probably not very useful. (Maybe in some highly constrained situation with very short-lived keys?)

More generally, this purports to be a key agreement protocol whose only ingredient is a hash function / one-way function used in a black-box way. It is known that such a thing is impossible:


  R Impagliazzo, S Rudich, Limits on the Provable Consequences of One-Way Permutations, CRYPTO 1988.