Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Alice has a message, generates a one time pad, encrypts her message and sends it to Bob. Bob generates his own one time pad, encrypts the message again, and sends it back to Alice. Alice then decrypts this message using her one time pad, sends it back to Bob who then decrypts it the last time using his one time pad.

The only problems I see with this technique:

  1. It is vulnerable to a man in the middle attack.
  2. It requires sending the message back and forth twice between sender and recipient.
  3. It doesn't scale well if you want to use it to communicate with multiple people.
  4. Requires a way of generating cryptographically secure random numbers.

Does this method of encryption have a name?

If we ignore the fact that it's vulnerable to a man in the middle attack, is this method of encryption information-theoretically secure?

Why isn't this method used widely, i.e. which of the above listed problems or other problems makes this method infeasible for production use?

share|improve this question
1  
An attacker who sees all the messages can trivially extract the plaintext with a bit of xor-ing. –  CodesInChaos Nov 10 '13 at 21:50
    
The general scheme is called Three-pass protocol and it's secure for some commutative ciphers, but simple xor is not one of them. –  CodesInChaos Nov 10 '13 at 21:55
    
@CodesInChaos, please add as an answer! –  user545424 Nov 10 '13 at 21:56
    
This question is a duplicate of crypto.stackexchange.com/questions/3379/…. This one's more nicely written, though, so I think I'll vote to close the other one. –  Ilmari Karonen Nov 11 '13 at 14:31
add comment

1 Answer 1

up vote 8 down vote accepted

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices.

Your scheme:

A->B: $c_1 = m \oplus a$

B->A: $c_2 = c_1 \oplus b$

A->B: $c_3 = c_2 \oplus a$

B computes $m = c_3 \oplus b$

an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can compute:

$c_1 \oplus c_2 \oplus c_3 = (m \oplus a) \oplus c_2 \oplus (c_2 \oplus a) = m$

and thus recovers the message.

share|improve this answer
    
So, for the protocols described in the Wikipedia article, the three-pass protocol is not information-theoretically secure, but still relies on being computationally difficult. –  user545424 Nov 10 '13 at 22:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.