What would be the recipe to add error propagation to a one time pad? I.e. if I change a single letter in the clear text message, I want the encrypted message to change starting from that letter and up to the end of the encrypted message.

  • $\begingroup$ You could encrypt the message with a conventional cipher (perhaps AES-SIV) or an unkeyed all-or-nothing transformation before encrypting with the one-time-pad. $\endgroup$ Oct 1, 2015 at 11:18
  • 2
    $\begingroup$ What's the goal of this modification? Which security properties do you want to achieve? In modern crypto it's standard practice to use a MAC to reject any modified ciphertexts. There are even MACs secure against computationally unbounded adversaries, which pair ideally with the one-time-pad. $\endgroup$ Oct 1, 2015 at 11:21
  • $\begingroup$ use GF multiplication for "key addition", and run the whole thing in 8-bit CBC? $\endgroup$ Oct 1, 2015 at 11:25
  • $\begingroup$ @RichieFrame: nit, $GF(2^{8})$ multiplication wouldn't work, as a 0 in the pad would kill things. However, $GF(257)$ multiplication (with the convention that the 0x00 byte stands for the value 256) would work. $\endgroup$
    – poncho
    Oct 1, 2015 at 13:13
  • 1
    $\begingroup$ @UnixJunkie, that goal is inachievable. The information theoretic security of OTP relies on its one-timeness. $\endgroup$
    – otus
    Oct 1, 2015 at 14:00

1 Answer 1


What you are actually looking for, which is a way to reuse a one-time pad, is not possible. For OTP reuse to be in any way secure, you need an algorithm with enough "complexity" to be a secure cipher (where the "pad" is actually a key).

For example, in the comments you raise the idea of including a random number and using the 8-bit CBC that Richie Frame and poncho mention. That would not work, because a known plaintext attack would reveal the pad, and the encryption of each byte would only depend on the encrypted value of the previous byte (known) and the pad at that point (recovered after a known plaintext attack).

For the title question the CBC idea is a valid answer, but it does not seem very useful. There is also a complementary question: is there a way to cause changes in the ciphertext to propagate through the plaintext. There e.g. the PCBC mode would work, but again I do not how useful that is.

As for actual suggestions, if you cannot handle the unique pad requirement of OTP (which is common), you should use a conventional cipher like AES. Preferably in authenticated encryption, so that error propagation does not need to be worried about.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.