# What is the name of this kind of protocol

There is a communication protocol that I believe creates the equivalent of a one time pad, with the downside that the secret message must be transferred multiple times. The protocol is so simple that I imagine that it has a name but I can't find a protocol which matches its description.

Assumptions:

1. A client C wants to send a password P of L bytes to a Server S.
2. A function Z(P,M) exists whereby both P and M are L bytes and

Z(P,M)= P[i] xor M[i]; for all i < L

Thus the protocol would work as follows:

1. C generates a random string of L bytes called CM. C sends to S: Q0 where Q0=Z(P,CM)
2. S generates a random string of L bytes called SM. S sends to C: Q1 where Q1=Z(Q0,SM)
3. C reapplies the CM mask to Q1. C sends to S Q2 where Q2=Z(Q1,CM).
4. S reapplies the SM mask to Q2. Q gets P from P=Z(Q2,SM)

The protocol is taking advantage of the fact that the xor operation is both associative and commutative.

-
Looks related to en.wikipedia.org/wiki/Three-pass_protocol which is insecure for xor, but works for some other commutative ciphers. – CodesInChaos Jul 29 '12 at 22:22
It'd be good to get the additional details about Three-pass protocol in the @D.W. answer migrated if this is going to be closed. – archie Nov 11 '13 at 18:59
@archie: I agree, these questions really should be merged. We can flag a mod to do that once one of them is closed. (We could do it before that, but then the mods would have to either wait or cast a binding close vote themselves.) – Ilmari Karonen Nov 11 '13 at 20:57

It is insecure. An eavesdropper gets to observe $Q_0 = P \oplus CM$, $Q_1 = Q_0 \oplus SM = P \oplus CM \oplus SM$, and $Q_2 = Q_1 \oplus CM = P \oplus SM$. Notice that we have the relation $$Q_0 \oplus Q_1 \oplus Q_2 = (P \oplus CM) \oplus (P \oplus CM \oplus SM) \oplus (P \oplus SM) = P.$$ Therefore, an eavesdropper who xor's the three messages he observes can recover the message $P$. In other words, this protocol is completely insecure.
You may be thinking of the three-pass protocol for key exchange. It is basically the same concept as what you have, but using something other than xor. With xor, this is insecure, but if you replace xor with an appropriate other operation, you can get something secure. The most well-known instantiation is to replace xor with Pohlig-Hellman exponentiation-based encryption. In that scheme, we set $Q_0 = P^c \pmod{p}$, $Q_1 = Q_0^s \pmod{p}$, $Q_2 = Q_1^{c^{-1}} \pmod{p}$, and then S can compute $P = Q_2^{s^{-1}} \pmod{p}$, where everything is done modulo a large prime $p$. However, the three-pass protocol has no advantages over standard public-key key-exchange systems, so it is rarely (if ever) used. For instance, its security is roughly equivalent to the security of Diffie-Hellman key-exchange, so it has no clear advantages over Diffie-Hellman or RSA.