I have 10 cipher texts ciphered with One Time Pad (OTP) using the same key.

I need to recover the key (or in other words, to recover the 11th cipher text which I assumed would require me to recover the key first).

I followed a technique called "Crib Drag" described in: Taking advantage of one-time pad key reuse? Simply, by XORing the word " the " (including spaces) with the result of (C1 XOR C2), I could recover 5-letters that make sense to me that it is a plain text.

However, I do not know whether this plain text belongs to P1 or P2.

Can you help me how to know if the plain text belongs to P1 or P2 ? How can I recover the key bytes if I could recover letters from P1 or P2 ? How can I check whether they belong to P1 or P2 ?

I tried several attempts but no hope. Please, help me to continue and recover the key using this method.

  • 1
    $\begingroup$ Use C3 to check. There are two possibilities; one in which P1 has " the ", and one in which P2 has " the "; by checking both against C3, the correct one should be obvious. $\endgroup$
    – poncho
    Commented Aug 6, 2015 at 22:04
  • $\begingroup$ @poncho I don't get it. I do not have P3. do you mean C3? Can you clarify using equations? $\endgroup$ Commented Aug 6, 2015 at 22:07
  • $\begingroup$ Sorry; I meant C3 $\endgroup$
    – poncho
    Commented Aug 6, 2015 at 22:09
  • $\begingroup$ I suggest to ignore this so-called "Crib Drag" method, because it is actually just a fancy name for the least efficient methods to analyze multi-time-pad. Please don't call it OTP, when it clearly isn't. This site should offer a lot of questions and answers to this topic. $\endgroup$
    – tylo
    Commented Aug 7, 2015 at 9:32

1 Answer 1


Assume that $P_1$ contains " the ". In that case you can get the key stream by XOR'ing " the " with $C_1$, lets call this key stream $K^1$. If this key stream is correct then $P_3^1$ should make sense, where $P_3^1 = K^1 \oplus C_3$. If $P_3^1$ doesn't make sense then you can create $K^2$ and $P_3^2$ from $C_2$ in using an identical calculation and check that.

Of course, as you've got 10 ciphertext you might as well check against $C_3$ to $C_{10}$. They all should make sense if you've got the right key stream at the location you are testing. Beware though that some professors find it funny to introduce single "mistakes" in the plaintext, forcing you to perform statistics (or "by eye" verification) instead.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.