# Can two people with different one time pads securely exchange a message like this?

Alice has a message, generates a one time pad, encrypts her message and sends it to Bob. Bob generates his own one time pad, encrypts the message again, and sends it back to Alice. Alice then decrypts this message using her one time pad, sends it back to Bob who then decrypts it the last time using his one time pad.

The only problems I see with this technique:

1. It is vulnerable to a man in the middle attack.
2. It requires sending the message back and forth twice between sender and recipient.
3. It doesn't scale well if you want to use it to communicate with multiple people.
4. Requires a way of generating cryptographically secure random numbers.

Does this method of encryption have a name?

If we ignore the fact that it's vulnerable to a man in the middle attack, is this method of encryption information-theoretically secure?

Why isn't this method used widely, i.e. which of the above listed problems or other problems makes this method infeasible for production use?

-
An attacker who sees all the messages can trivially extract the plaintext with a bit of xor-ing. – CodesInChaos Nov 10 '13 at 21:50
The general scheme is called Three-pass protocol and it's secure for some commutative ciphers, but simple xor is not one of them. – CodesInChaos Nov 10 '13 at 21:55
This question is a duplicate of crypto.stackexchange.com/questions/3379/…. This one's more nicely written, though, so I think I'll vote to close the other one. – Ilmari Karonen Nov 11 '13 at 14:31

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices.

A->B: $c_1 = m \oplus a$

B->A: $c_2 = c_1 \oplus b$

A->B: $c_3 = c_2 \oplus a$

B computes $m = c_3 \oplus b$

an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can compute:

$c_1 \oplus c_2 \oplus c_3 = (m \oplus a) \oplus c_2 \oplus (c_2 \oplus a) = m$

and thus recovers the message.

-
So, for the protocols described in the Wikipedia article, the three-pass protocol is not information-theoretically secure, but still relies on being computationally difficult. – user545424 Nov 10 '13 at 22:07