# XOR cipher Pseudo-random key strength

When implementing a XOR cipher with a pseudo-random key equal in length to the plaintext, Is there a significant difference in potential key strength between keys drawn from a pool of either 1000 or 5000 possible characters? (that is, each character in the key may be any one of up to five thousand possible characters) Or is this not likely to be a deciding factor in overall security for a simple XOR?

Edit: I apologize if my original phrasing was ambiguous. I have hopefully improved it a bit. (Character pool = A group of distinct character from which the cipher key may be generated.)

-
By "Character pool", do you mean each character is sampled from a set of $1000$ or $5000$ possible characters, or a key of length $1000$? –  figlesquidge Nov 23 '13 at 9:27
I agree, without defining "character pool" there is no answering this question. This seems to yet another scheme to create a very slow stream cipher out of a one-time pad. –  owlstead Nov 23 '13 at 18:06
As the question is, it is not possible to answer it. Could you add a definition of "character pool", and how it relates to your pseudo-random key? –  Paŭlo Ebermann Nov 23 '13 at 18:54
@Daniel: How are you "randomly selecting " the predefined characters and how is this table of characters generated? If as you say you don't care that the Mersenne is not cryptographically secure, why worry about the quasi-randomness of your key? –  William Hird Dec 1 '13 at 20:02
@e-sushi Thanks for the tip! I will look into it. :) –  Daniel Dec 1 '13 at 21:36

Now, I take it you're intending to obey the no-reuse requirement, which leaves us with the question of what happens when my data isn't quite random enough? Firstly, lets try and work out what a pool of 1000 characters would mean. To run an xor-cipher, we somehow translate the string of characters into a string of bits, using one of many character encodings. There are $2^8=256$ bits in a byte, so I deduce that by character you mean that each character is encoded into two-bytes (which is roughly how UTF-16 seems to work if you don't require very strange characters), meaning there are a total of $2^{16}=65536$ possible characters.
Now, how are you picking $1000$, or indeed $5000$ from them? If they're not randomly sampled from the total options, then you risk letting through some very significant information. For example, if your set is based around "common" characters then because of the way the character sets are constructed there are certain bits which are more likely to be set / not set in your collection of characters.
If you have managed to sample them totally randomly, then at the very least you're loosing out against a naive attack since there are only $1/5$ of the values to check.