If I have a long randomly generated key (k), XORed with a message (m), but since the message is longer than the key, there is a chance of reusing the keystream with the same message, but the key is used only onetime for every encryption process. In other words, every time I have to encrypt a message, I randomly generate a bit key with variable length. Can we consider this technique is secure against any attack even though the keystream is been reused with the same message despite the fact that I have to save the key for every message I encrypt?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Apart from the obvious security vulnerability from using a simple XOR operation to convert between plaintext and ciphertext you also run into the massive security-flaw of each identical plaintext generates identical ciphertext.
In any given message, if a constant cipher operation is used along with a constant key, the resultant ciphertext will be same for every plaintext irrespective of the position of the plaintext within the message. This property causes patterns in the original plaintext to be revealed in the ciphertext.
Take for instance AES-ECB where even though a strong block cipher (AES) is used, a cipher operation that generates identical ciphertext for identical plaintext exposes the "pattern" of the message.
For a visual demonstration of this problem consider these images:
This is due to the fact that every white sector in the image is passed through the cipher operation and generates an identical ciphertext causing the areas with differing colour to produce differing ciphertext in a manner that exposes the patterns of the original image.
To summarize, not only are you using an extremely insecure cipher operation of XOR (Information of why it is insecure is cluttered all over the web), using a cipher that generates ciphertext that is identical when the plaintext is identical is a security flaw in itself. Given that you are reusing the keystream for messages longer than the key, you definitely fall for both these vulnerabilities.