Lets say we have a message $m$ that we encrypt with two keys $k_1, k_2$ such that $k_1 \ne k_2$. This will produce two ciphertexts $c_1, c_2$ such that $c_1 = m \oplus k_1, c_2 = m \oplus k_2$.

The attacker managed to get the two ciphertexts and also has the knowledge that both ciphertexts $c_1, c_2$ represent the same message. Does this knowledge lower the OTP security in any way?


2 Answers 2


The most an attacker can find out is that $c_1 \oplus c_2 = m \oplus k_1 \oplus m \oplus k_2 = k_1 \oplus k_2$. But since both $k_1$ and $k_2$ are fully random and not reused it won't help the attacker to find either $k_1$ or $k_2$. Basically each key stream is still encrypted with the other key stream.

Note that for OTP $k_1 \ne k_2$ is an invalid constraint; the keys should be fully independent of each other. For instance, if you have $k_1 = C | 0$ and $k_1 = C | 1$ where $C$ is a constant then $k_1 \ne k_2$. Those keys do however not represent valid OTP key streams; those must be fully random. Fully random also means that $k_1 = k_2$ is a possibility. If you know that the message is always identical then $k_1 \ne k_2$ means that if you get $c_1 = c_2$ that the messages differ.

So given the invalid constraint that $k_1 \ne k_2$ is true, then the answer of the question is yes - the security is lowered. If the keys are truly random then the answer is no.


$c_2 \: = \: m\oplus k_2 \: = \: m\oplus k_1 \oplus k_1 \oplus k_2 \: = \: c_1 \oplus k_1 \oplus k_2$

$k_1 \oplus k_1 \: = \: 00000...00000$

Since fixing either argument turns xor into a bijection, the distribution of $\: k_1 \oplus k_2$
is uniform on non-zero strings. $\;\;\;$ Thus, knowledge of $c_1$ is enough to sample from
$c_2$'s distribution, so that knowledge does not "lower the OTP security in any way".

However, if the attacker does not have "the knowledge that both ciphertexts $c_1,c_2$ represent
the same message", then forcing $\: k_1 \neq k_2 \:$ would be a vulnerability for short keys, since
$c_1 = c_2 \:$ would automatically-mean or suggest (depending on whether message length is or
isn't equal to key length) that the messages were different. $\;\;\;$ (To avoid that, $\: k_2 = k_1 \:$ should
be just as likely as any other possible value for $k_2$, rather than guaranteed to not be the case.)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.