Why is the XOR of plaintexts equal to the XOR of ciphertexts with a two time pad?

Question

I have been working in the vulnerabilities of the Two Time Pad. So i found in a lot of places, StackExchange included saying, that if two plain texts are encrypted (using XOR) with the same key the following is valid:

plaintext1 XOR plaintext2 = ciphertext1 XOR ciphertext2

Is there any proof about that, mathematical or otherwise, that the above exists always?

Answer 1

We know, by the encryption rule for one-time pads, where $k$ is the re-used pad:

$p_1 \oplus k = c_1$ and $p_2 \oplus k = c_2$.

For $\oplus$ (xor) the following arithmetic is valid: $a \oplus a = 0$ for all $a$ (everything is its own inverse), which is clear from truth tables, e.g., and $a \oplus (b \oplus c) = (a \oplus b) \oplus c$, i.e. the operation is associative and $a \oplus b = b \oplus a$ for all $a,b$ (the order does not matter, i.e. the operation is commutative).

These properties should be familiar, and they show, among other things, that decryption of the one-time pad is the same operation as encryption: if $c_1 = p_1 \oplus k$, then $c_1 \oplus k = (p_1 \oplus k) \oplus k = p_1 \oplus (k \oplus k) = p_1 \oplus 0 = p_1$, so re-encrypting $c_1$ as it were, gives back $p_1$, which is a very convenient property.

Also $c_1 \oplus c_2 = (p_1 \oplus k) \oplus (p_2 \oplus k) = p_1 \oplus p_2 \oplus (k \oplus k)$ after re-arranging brackets (associative!) and shuffling (commutative) and the last term is $0$ again, so we are left with $c_1 \oplus c_2 = p_1 \oplus p_2$, as claimed. The re-used $k$ cancels out, in short. If we'd have used $k_1$ independent from $k_2$, we wouldn't have had such a relationship.