Tag Info

Hot answers tagged

3

$c_2 \: = \: m\oplus k_2 \: = \: m\oplus k_1 \oplus k_1 \oplus k_2 \: = \: c_1 \oplus k_1 \oplus k_2$ $k_1 \oplus k_1 \: = \: 00000...00000$ Since fixing either argument turns xor into a bijection, the distribution of $\: k_1 \oplus k_2$ is uniform on non-zero strings. $\;\;\;$ Thus, knowledge of $c_1$ is enough to sample from $c_2$'s distribution, so ...


2

The most an attacker can find out is that $c_1 \oplus c_2 = m \oplus k_1 \oplus m \oplus k_2 = k_1 \oplus k_2$. But since both $k_1$ and $k_2$ are fully random and not reused it won't help the attacker to find either $k_1$ or $k_2$. Basically each key stream is still encrypted with the other key stream. Note that for OTP $k_1 \ne k_2$ is an invalid ...



Only top voted, non community-wiki answers of a minimum length are eligible