# OTP same message encrypted twice (with different keys)

Lets say we have a message $m$ that we encrypt with two keys $k_1, k_2$ such that $k_1 \ne k_2$. This will produce two ciphertexts $c_1, c_2$ such that $c_1 = m \oplus k_1, c_2 = m \oplus k_2$.

The attacker managed to get the two ciphertexts and also has the knowledge that both ciphertexts $c_1, c_2$ represent the same message. Does this knowledge lower the OTP security in any way?

The most an attacker can find out is that $c_1 \oplus c_2 = m \oplus k_1 \oplus m \oplus k_2 = k_1 \oplus k_2$. But since both $k_1$ and $k_2$ are fully random and not reused it won't help the attacker to find either $k_1$ or $k_2$. Basically each key stream is still encrypted with the other key stream.

Note that for OTP $k_1 \ne k_2$ is an invalid constraint; the keys should be fully independent of each other. For instance, if you have $k_1 = C | 0$ and $k_1 = C | 1$ where $C$ is a constant then $k_1 \ne k_2$. Those keys do however not represent valid OTP key streams; those must be fully random. Fully random also means that $k_1 = k_2$ is a possibility. If you know that the message is always identical then $k_1 \ne k_2$ means that if you get $c_1 = c_2$ that the messages differ.

So given the invalid constraint that $k_1 \ne k_2$ is true, then the answer of the question is yes - the security is lowered. If the keys are truly random then the answer is no.

$c_2 \: = \: m\oplus k_2 \: = \: m\oplus k_1 \oplus k_1 \oplus k_2 \: = \: c_1 \oplus k_1 \oplus k_2$

$k_1 \oplus k_1 \: = \: 00000...00000$

Since fixing either argument turns xor into a bijection, the distribution of $\: k_1 \oplus k_2$
is uniform on non-zero strings. $\;\;\;$ Thus, knowledge of $c_1$ is enough to sample from
$c_2$'s distribution, so that knowledge does not "lower the OTP security in any way".

However, if the attacker does not have "the knowledge that both ciphertexts $c_1,c_2$ represent
the same message", then forcing $\: k_1 \neq k_2 \:$ would be a vulnerability for short keys, since
$c_1 = c_2 \:$ would automatically-mean or suggest (depending on whether message length is or
isn't equal to key length) that the messages were different. $\;\;\;$ (To avoid that, $\: k_2 = k_1 \:$ should
be just as likely as any other possible value for $k_2$, rather than guaranteed to not be the case.)