Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Wikipedia article "One-time pad ~ Authentication" says :

For example, an attacker who knows that the message contains "meet jane and me tomorrow at three thirty pm" at a particular point can replace that content by any other content of exactly the same length, such as "three thirty meeting is cancelled, stay home", without having access to the one-time pad, a property of all stream ciphers known as malleability.

I don't quite understand how it's possible.

Let's say the string is encrypted using one-pad time. Hacker somehow gets that encrypted text and he knows that the last word contains 6 chars. So, he removes last 6 chars from the ciphertext and he wants to add his own 6 character word. How he can do that?

If he just inserts that word, after the decryption that inserted word becomes most likely just gibberish. Or am I wrong?

share|improve this question
Actually, this works with any synchronous stream cipher, not just with one-time-pads. – Paŭlo Ebermann Aug 29 '13 at 8:06
It works because of a failure to hash-sum the data. – Joshua Oct 23 '13 at 1:35
up vote 7 down vote accepted

It is quite simple and stems from the idea that flipping one bit in the ciphertext flips the corresponding bit in the plaintext.

So, say the ciphertext is $1011$ and we know the plaintext is $0101$ (thus the key is $1110$). Say we want a plaintext of $0000$, we just have to change the ciphertext to $1110$ (notice where the bits have been flipped) and we have $1110\oplus 1110=0000$

In that sense you if you can flip any bits you want and you know what the plaintext says and you know what you want the plaintext to say, you flip the right bits in the ciphertext and decryption comes out as you desired.

share|improve this answer

It works with modular-arithmetic-based one-time pads as well.

If somehow we know this part of a ciphertext…


…we can decrypt it to this message…


Then the key would have to be this:


You can verify this by entering the "MEET JANE AT..." as a key for this message at and clicking Decrypt. It will return the key. Once you know the key, you can make any new ciphertext you want and replace the original "MEET JANE…". Replace the first HZIV in the ciphertext with FDPN and Jane has a much different kind of meeting tomorrow.

I think maybe what you're getting hung up on is something that the Wikipedia article doesn't explicitly say: you'll know not only the plaintext but the corresponding ciphertext. Once you have both, you have the key for that part of the message.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.