Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Alice has a message, generates a one time pad, encrypts her message and sends it to Bob. Bob generates his own one time pad, encrypts the message again, and sends it back to Alice. Alice then decrypts this message using her one time pad, sends it back to Bob who then decrypts it the last time using his one time pad.

The only problems I see with this technique:

  1. It is vulnerable to a man in the middle attack.
  2. It requires sending the message back and forth twice between sender and recipient.
  3. It doesn't scale well if you want to use it to communicate with multiple people.
  4. Requires a way of generating cryptographically secure random numbers.

Does this method of encryption have a name?

If we ignore the fact that it's vulnerable to a man in the middle attack, is this method of encryption information-theoretically secure?

Why isn't this method used widely, i.e. which of the above listed problems or other problems makes this method infeasible for production use?

share|improve this question
An attacker who sees all the messages can trivially extract the plaintext with a bit of xor-ing. – CodesInChaos Nov 10 '13 at 21:50
The general scheme is called Three-pass protocol and it's secure for some commutative ciphers, but simple xor is not one of them. – CodesInChaos Nov 10 '13 at 21:55
@CodesInChaos, please add as an answer! – user545424 Nov 10 '13 at 21:56
This question is a duplicate of…. This one's more nicely written, though, so I think I'll vote to close the other one. – Ilmari Karonen Nov 11 '13 at 14:31
up vote 9 down vote accepted

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices.

Your scheme:

A->B: $c_1 = m \oplus a$

B->A: $c_2 = c_1 \oplus b$

A->B: $c_3 = c_2 \oplus a$

B computes $m = c_3 \oplus b$

an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can compute:

$c_1 \oplus c_2 \oplus c_3 = (m \oplus a) \oplus c_2 \oplus (c_2 \oplus a) = m$

and thus recovers the message.

share|improve this answer
So, for the protocols described in the Wikipedia article, the three-pass protocol is not information-theoretically secure, but still relies on being computationally difficult. – user545424 Nov 10 '13 at 22:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.