Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

These terms are confusing me. One time pad is when you use one key for one message. That is what One time key is.

Secondly, what is the connection of many time key, can i use one time pad many times, will it become many time key.

share|improve this question
up vote 1 down vote accepted

A one-time key is when the encryption scheme is set up such that only one message may be encrypted with a key. A many-time key is when multiple messages may be encrypted with a key. (A one-time-pad is a special case of a one-time key.)

The semantic security definitions for one-time and many-time keys for block ciphers may help. In both, an adversary $A$ submits two plaintext messages $m_1$ and $m_2$ to a black box that internally chooses one of $m_1$ and $m_2$ at random (namely, $m_i$ with $i \in \{0,1\}$ at random), encrypts $m_i$ with a randomly chosen key $k$, and outputs the ciphertext $C = E_k(m_i)$. Adversary $A$ wins if they can find a way of successfully guessing which of $m_1$ or $m_2$ were encrypted and output as $C$.

For the one-time key security model, the attacker gets to submit only one pair of messages. He must then launch his attack having only one input/output to observe. For the many-time key security model, the attacker gets to submit and observe a nearly unlimited number of message input/output pairs. (The choices of $i$ and $k$ remain fixed across each submission for the many-key model.)

To be secure in the many-time key model, the encryption scheme $E$ used above must be randomized. If it is not, then $A$ will break semantic security easily. $A$ will make three random messages and submit $m_1$ and $m_2$ in the first round and get back $c_1$, then $m_1$ and $m_3$ in the second round and get back $c_2$. If $c_1 = c_2$ then the ciphertexts are equal which means the encrypted plaintexts were equal, so the blackbox is encrypting the first message (which was the same in both submissions). If the ciphertexts are different, then the blackbox is encrypting the second message (which was different between the submissions). (Note that security for $E$ does not have to be randomized in the one-time key model.)

Example: CTR mode with a fixed IV is secure in the one-time key model, but insecure in the many-time key model. CTR with a nonce is secure in both models.

share|improve this answer
thanks. and what about ECB? is it one time key or many time key case? is it semantically secure? – khunshan Aug 22 '12 at 22:22
Whether a scheme is a one-time key or a many-time key depends on whether it is secure or not secure in the one-time or many-time models. ECB is not semantically secure in either model (if your message can be more than one block long). – B-Con Aug 22 '12 at 22:29
u r absolutely ok. – khunshan Aug 30 '12 at 21:34

One Time Pad(OTP) is : m+k=c where k and m have exactly the same length.
If you use same OTP key for encryption more than once there will be a simple attack, namely:
m1+k = c1
m2+k = c2
m1+m2 = c1+c2
From frequency of words in languages or knowing the protocols it breaks the system
If you want to use just one key for encryption of many messages you should also provide semantic security(same messages have different ciphertexts). You can use CBC, CTR, nCTR,... which use a pseudorandom function(like AES-256) and a single key.(there is some security observations for nCBC since it needs two independent keys)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.