7
$\begingroup$

Alice has a message, generates a one time pad, encrypts her message and sends it to Bob. Bob generates his own one time pad, encrypts the message again, and sends it back to Alice. Alice then decrypts this message using her one time pad, sends it back to Bob who then decrypts it the last time using his one time pad.

The only problems I see with this technique:

  1. It is vulnerable to a man in the middle attack.
  2. It requires sending the message back and forth twice between sender and recipient.
  3. It doesn't scale well if you want to use it to communicate with multiple people.
  4. Requires a way of generating cryptographically secure random numbers.

Does this method of encryption have a name?

If we ignore the fact that it's vulnerable to a man in the middle attack, is this method of encryption information-theoretically secure?

Why isn't this method used widely, i.e. which of the above listed problems or other problems makes this method infeasible for production use?

Improve this question
$\endgroup$
5
  • 3
    $\begingroup$ An attacker who sees all the messages can trivially extract the plaintext with a bit of xor-ing. $\endgroup$
    – CodesInChaos
    Nov 10, 2013 at 21:50
  • 1
    $\begingroup$ The general scheme is called Three-pass protocol and it's secure for some commutative ciphers, but simple xor is not one of them. $\endgroup$
    – CodesInChaos
    Nov 10, 2013 at 21:55
  • $\begingroup$ @CodesInChaos, please add as an answer! $\endgroup$
    – user545424
    Nov 10, 2013 at 21:56
  • $\begingroup$ This question is a duplicate of crypto.stackexchange.com/questions/3379/…. This one's more nicely written, though, so I think I'll vote to close the other one. $\endgroup$
    – Ilmari Karonen
    Nov 11, 2013 at 14:31
  • $\begingroup$ See also "Cracking nested one-time-pads" over on puzzling.se (and be sure to check the accepted answer): puzzling.stackexchange.com/questions/63177/… $\endgroup$
    – Oliphaunt
    Feb 16, 2022 at 22:42

1 Answer 1

Reset to default
12
$\begingroup$

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices.

Your scheme:

A->B: $c_1 = m \oplus a$

B->A: $c_2 = c_1 \oplus b$

A->B: $c_3 = c_2 \oplus a$

B computes $m = c_3 \oplus b$

an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can compute:

$c_1 \oplus c_2 \oplus c_3 = (m \oplus a) \oplus c_2 \oplus (c_2 \oplus a) = m$

and thus recovers the message.

Improve this answer
$\endgroup$
1
  • $\begingroup$ So, for the protocols described in the Wikipedia article, the three-pass protocol is not information-theoretically secure, but still relies on being computationally difficult. $\endgroup$
    – user545424
    Nov 10, 2013 at 22:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.