Why is the following protocol never used to share a symetric key between two parties ? ⊕ is the XOR operation.

Alice has M and wants to send it to Bob. Alice generates K₁ randomly. Bob generates K₂ randomly.

  • Alice has M.
  • Alice : M -- ·⊕K₁ --> M⊕K₁
  • Alice sends M⊕K₁ to Bob.
  • Bob : M⊕K₁ -- ·⊕K₂ --> M⊕K₁⊕K₂
  • Bob sends M⊕K₁⊕K₂ to Alice.
  • Alice : M⊕K₁⊕K₂ -- ·⊕K₁ --> M⊕K₂
  • Alice sends M⊕K₂ to Bob.
  • Bob: M⊕K₂ -- ·⊕K₂ --> M
  • Bob has M.

Of course, K₁ and K₂ need to be the same size as M.

  • 1
    $\begingroup$ This is the Three-pass_protocol. It's not secure when using xor, but secure for certain other operations. $\endgroup$ Commented Aug 5, 2023 at 13:20
  • $\begingroup$ If you look through the three-pass-protocol-tag you'll find a couple of duplicates. $\endgroup$ Commented Aug 5, 2023 at 13:20

1 Answer 1


Here's why it doesn't work:

Suppose someone in the middle hears $M \oplus K_1$, $M \oplus K_1 \oplus K_2$ and $M \oplus K_2$.

Then, what they could do is xor the three of them together, giving:

$$(M \oplus K_1) \oplus (M \oplus K_1 \oplus K_2) \oplus (M \oplus K_2) = M$$

Thus recovering the message.

  • $\begingroup$ Thank you, I am really brain dead :| $\endgroup$
    – Pierromer
    Commented Aug 5, 2023 at 10:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.