SHA-256-based stream cipher Can anyone comment if the stream cipher described  here is safe? The author claims it to be unbreakable, but does not provide any evidence or proof to support this. For completeness, I have reproduced the algorithm below.

Encryption routine (Alice$\to$Bob)


Calculates a shared secret:
$s=$Curve25519(Alice_private_key, Bob_public_key)
Calculates N seeds $s_1,\dots,s_n$:
$$s_0 = \mathrm{SHA256}(s);\quad s_n = \mathrm{SHA256}(s_{n-1})$$
Calculates N keys $k_1,\dots,k_n$:
$$k_n = \mathrm{SHA256}(\overline{s_n})$$
(where $\bar{s}$ is the bitwise compliment of $s$)
Encrypts the plaintext via xor:
$$c_n = p_n \oplus k_n$$


Upon receipt Bob decrypts the ciphertext by repeating the identical steps, except he derives the shared secret $s$ using his private key and Alice's public key.
Some brief thoughts:

Shared secret Generation:
$$s=E_a(B)=E_b(A)$$
The shared secret is generated by encrypting the other users public key with your private key. This is effectively an ECDH step, which is very reasonable, and one of the key aims of C25519$^{[1]}$. 

Key Generation:
$$s_0=\mathrm{SHA256}(s); s_i=\mathrm{SHA256}(s_{i-1})$$
First, using the definition above, they generate seeds. This doesn't seem an unreasonable way of expanding one seed into many.
$$k_n = \mathrm{SHA256}(\overline{s_n})$$
Yes, I'm happy that the $k_n$ should look pretty random.

Xor combinator:
This isn't at all unreasonable, and most stream-ciphers use this technique for combining their stream with the plaintext.

Overall?
Assuming the relation required in the first step holds, which I'm unsure and sceptical about, then first impressions are that this scheme should be ok. At the end of the day it's basically using ecdh to seed a $\mathrm{SHA256}$-based stream cipher. Cryptographically, this means it will at best have the security bounds from the weakest of those primitives. Whilst this is certainly not genuinely 'unbreakable', it should be computationally secure. However, there are some far more significant issues with it that won't be addressed by 'is it secure'? I'll note some of them now...

Key reuse
As noted by the original author, this scheme only generates a single key-stream, seeded by the two public keys through the ECDH step. The dangers of reusing an xor keystream are severe - it leaks the xor of the plaintexts, which is often sufficient to allow a total break:
$$c_a=m_a\oplus K;c_b=m_b\oplus K \implies c_a\oplus c_b = m_a\oplus m_b$$
This could be resolved by adding a nonce to the original step, which is arguably the biggest issue of the scheme. That is,
$$s_0=\mathrm{SHA256}(s||N)$$
Where $N$ is a nonce, although it does not have to be unpredictable.

Why should I care?
This is the biggest issue with most homebrew schemes. Unless a scheme can demonstrate some advantage over the other schemes in existence, then why on earth wouldn't I just use those? In this case, it won't be particularly quick given the number of SHA calls made, won't be very nice to parellelise due to the recursive nature by which the stream is generated, and after all that it's just an xor-based stream cipher. See this question for why you should always think at least 3$^{[1]}$ times before using an encryption algorithm rather than an authenticated encryption algorithm.



[1]: Thanks to DrLecter for clarification on this point.

[2]: In the old days, people used to be told "think twice before doing $x$". However, as we are all aware, lots of people still did $x$. As such, I'm pushing for raising the number of "think's" required. Obviously as a cryptographer I'd like to go for at least 64-bit security, but for now 3 will have to do.