# Tag Info

3

No, because then you could calculate $z_1 \oplus z_2 = (m_1 \land m_2) \oplus (m_1 \lor m_2) = m_1 \oplus m_2$. In practice, you can only find $m_1 \oplus m_2$ if both $m_1$ and $m_2$ are encrypted with the same OTP (i.e., $(m_1 \oplus y_1) \oplus (m_2 \oplus y_1) = m_1 \oplus m_2$). So without any knowledge of $m_1$, $m_2$, $y_1$ or $y_2$, there is no way ...

2

The proof for the perfect secrecy property of the one time pad is quite simple. It makes use of basic probabilities and it says that: $$Pr[M=m|C=c]=Pr[M=m]$$ for a probability distribution M$\{0,1\}^n$ for the message space and a probability space C for the ciphertext space. Proof: Pr[C=c]=\sum{Pr[C=c|M=m']\cdot Pr[M=m']} =\sum{Pr[K=m'\oplus c]}\cdot ...

1

What you are describing is One-Time-Pad encryption, and yes it does have perfect secrecy. Note that for any ciphertext $y$ there is exactly one key $k'$ for each possible plaintext $x'$ so that $E_k(x') = y$. So if you choose the key uniformly at random the ciphertext gives no information on the plaintext, because any plaintext is equally likely.

1

Through repeated DH attempts, could Alice and Bob build a large random key for use as a one-time pad? No, since that is not how a one time pad works. You can use your idea to create cryptographic material to encrypt plaintext using XOR, what you are describing is an asymmetric stream cipher of some sorts. A one time pad requires an "offline" exchange ...

Only top voted, non community-wiki answers of a minimum length are eligible