# Can you really insert the text you want in one-time pad?

The Wikipedia article "One-time pad ~ Authentication" says :

For example, an attacker who knows that the message contains "meet jane and me tomorrow at three thirty pm" at a particular point can replace that content by any other content of exactly the same length, such as "three thirty meeting is cancelled, stay home", without having access to the one-time pad, a property of all stream ciphers known as malleability.

I don't quite understand how it's possible.

Let's say the string is encrypted using one-pad time. Hacker somehow gets that encrypted text and he knows that the last word contains 6 chars. So, he removes last 6 chars from the ciphertext and he wants to add his own 6 character word. How he can do that?

If he just inserts that word, after the decryption that inserted word becomes most likely just gibberish. Or am I wrong?

• Actually, this works with any synchronous stream cipher, not just with one-time-pads. Aug 29, 2013 at 8:06
• It works because of a failure to hash-sum the data. Oct 23, 2013 at 1:35

It is quite simple and stems from the idea that flipping one bit in the ciphertext flips the corresponding bit in the plaintext.

So, say the ciphertext is $1011$ and we know the plaintext is $0101$ (thus the key is $1110$). Say we want a plaintext of $0000$, we just have to change the ciphertext to $1110$ (notice where the bits have been flipped) and we have $1110\oplus 1110=0000$

In that sense you if you can flip any bits you want and you know what the plaintext says and you know what you want the plaintext to say, you flip the right bits in the ciphertext and decryption comes out as you desired.

It works with modular-arithmetic-based one-time pads as well.

If somehow we know this part of a ciphertext:

HZIVQ JJGTY GKBSI IWMVV HIYTA YHHDV XLBOK O


--will decrypt it to this message:

MEETJ ANEAN DMETO MORRO WATTH REETH IRTYP M


--then the key would have to be this:

UUDBG IVBSK CXWYT VHUDG KHEZS GCCJN OTHPU B


Once you know the key, you can make any new ciphertext you want and replace the original MEET JANE. Replace the first HZIV in the ciphertext with FDPN and Jane has a much different kind of meeting tomorrow.

I think maybe what you're getting hung up on is something that the Wikipedia article doesn't explicitly say: you'll know not only the plaintext but the corresponding ciphertext. Once you have both, you have the key for that part of the message.