# Tag Info

2

According to the definition on Wikipedia, both are valid uses of the term "one time pad" - "each bit or character of the plaintext is encrypted by combining it with the corresponding bit or character from the pad using modular addition." - that is: e=(d+p)%m, where e=encrypted data, d=decrypted data (input), p=pad, m is the number of possible values in e, d, ...

3

$c_2 \: = \: m\oplus k_2 \: = \: m\oplus k_1 \oplus k_1 \oplus k_2 \: = \: c_1 \oplus k_1 \oplus k_2$ $k_1 \oplus k_1 \: = \: 00000...00000$ Since fixing either argument turns xor into a bijection, the distribution of $\: k_1 \oplus k_2$ is uniform on non-zero strings. $\;\;\;$ Thus, knowledge of $c_1$ is enough to sample from $c_2$'s distribution, so ...

2

The most an attacker can find out is that $c_1 \oplus c_2 = m \oplus k_1 \oplus m \oplus k_2 = k_1 \oplus k_2$. But since both $k_1$ and $k_2$ are fully random and not reused it won't help the attacker to find either $k_1$ or $k_2$. Basically each key stream is still encrypted with the other key stream. Note that for OTP $k_1 \ne k_2$ is an invalid ...

2

What you need for this is something called an $n$-wise independent hash function (like "pairwise independent" but $n$ instead). Such a hash function has the property that when applied to at most $n$ different inputs, its outputs are completely random. These can be constructed efficiently; e.g., a random polynomial of the appropriate degree works. What you ...

1

Perfect secrecy requires that your key be as long as the plaintext you are encrypting. If you want to use the same key to encrypt multiple messages, you can use each part of the key once as a one-time pad. Your idea (assuming you fix the issue raised by poncho) seems to be just a more complicated way to achieve the same thing. If you remove the ...

1

Both constructions are not perfectly secure! In an attempt to express things a bit more mathematically, I'd say you can implement a one-time-pad with a message $m$ and a key $r$, when $m$ and $r$ are elements of $\mathbb{Z}/n\mathbb{Z}$, the additive group of integers modulo n, or when $m$ and $r$ are elements of a group $G$ isomorphic to ...

0

After those very helpful hints by poncho and yyyyyyy the answers are now obvious and I'll briefly argue why each of the construction is perfectly secure or not. Concerning construction 1: It can't be perfectly secure because it has been proven that perfect secrecy (=perfect security) requires the keyspace $\mathcal K$ to be as large as the message space ...

2

Assume that $P_1$ contains " the ". In that case you can get the key stream by XOR'ing " the " with $C_1$, lets call this key stream $K^1$. If this key stream is correct then $P_3^1$ should make sense, where $P_3^1 = K^1 \oplus C_3$. If $P_3^1$ doesn't make sense then you can create $K^2$ and $P_3^2$ from $C_2$ in using an identical calculation and check ...

3

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? No. (Please keep reading…) A single mathematical formula won’t cut it. That’s where cryptographic algorithms come in. There are more than a handfull of cryptographically secure ...

3

In order to achieve very high security for privacy, would it be cryptographically secure to use one time pad ciphers in emails? OTP offers perfect secrecy, so if it's feasible to use it, it is secure. However, OTP alone offers no authentication and leaves the message malleable. If Alice sends a message Y to Bob, standing for 'yes', Mallory can guess ...

4

No, that doesn't work. OTP is secure because knowledge of the plaintext doesn't give you any useful information about the key. This is because the bits of the key (e.g. $P_0$) are never used to encrypt anything else. If you would somehow reuse the key then leakage of the plaintext would cause leakage of $P_0$. Leakage of $P_0$ directly leaks $P_1$. I.e. ...

3

Sorry, I would only give partial points for a CCA attack on this scheme. The answer by @SEJPM is of course correct (and very informational so it's good it was posted). However, it is not the "best" answer, since this scheme can be easily broken under a chosen-plaintext attack. I will not write the full answer out (so that I can leave some work to be done for ...

3

This scheme follows the KEM/DEM approach of contructing secure asymmetric encryption schemes. However for a KEM/DEM PKCS (public key cryptosystem) to be secure it is required that both the key encapsulation mechanism (KEM) and the data encapsulation mechanism (DEM) are CPA or CCA secure for CPA or CCA of the whole scheme. Indeed the DEM looks CPA secure as ...

Top 50 recent answers are included