# Why is the XOR of plaintexts equal to the XOR of ciphertexts with a two time pad?

I have been working in the vulnerabilities of the Two Time Pad. So i found in a lot of places, StackExchange included saying, that if two plain texts are encrypted (using XOR) with the same key the following is valid:

plaintext1 XOR plaintext2 = ciphertext1 XOR ciphertext2


Is there any proof about that, mathematical or otherwise, that the above exists always?

• Hints: ciphertextj = plaintextj XOR Pad. Properties of XOR. – fgrieu Nov 8 '15 at 11:14
• @fgrieu Sorry i did not understand. If you mean that plaintext XOR key = ciphertext i know that. Though what i need is a proof of the above as mentioned – jvor Nov 8 '15 at 11:43
• Hint: What relations do you have at hand if you have two encryptions using the same key? – SEJPM Nov 8 '15 at 11:52
• @SEJPM I am not exactly an expert on the subject, though the one that would come to mind is the one i want to prove. Also, the bits in the same position of both ciphertexts will be the same if original text is the same – jvor Nov 8 '15 at 12:12

We know, by the encryption rule for one-time pads, where $k$ is the re-used pad:
$p_1 \oplus k = c_1$ and $p_2 \oplus k = c_2$.
For $\oplus$ (xor) the following arithmetic is valid: $a \oplus a = 0$ for all $a$ (everything is its own inverse), which is clear from truth tables, e.g., and $a \oplus (b \oplus c) = (a \oplus b) \oplus c$, i.e. the operation is associative and $a \oplus b = b \oplus a$ for all $a,b$ (the order does not matter, i.e. the operation is commutative).
These properties should be familiar, and they show, among other things, that decryption of the one-time pad is the same operation as encryption: if $c_1 = p_1 \oplus k$, then $c_1 \oplus k = (p_1 \oplus k) \oplus k = p_1 \oplus (k \oplus k) = p_1 \oplus 0 = p_1$, so re-encrypting $c_1$ as it were, gives back $p_1$, which is a very convenient property.
Also $c_1 \oplus c_2 = (p_1 \oplus k) \oplus (p_2 \oplus k) = p_1 \oplus p_2 \oplus (k \oplus k)$ after re-arranging brackets (associative!) and shuffling (commutative) and the last term is $0$ again, so we are left with $c_1 \oplus c_2 = p_1 \oplus p_2$, as claimed. The re-used $k$ cancels out, in short. If we'd have used $k_1$ independent from $k_2$, we wouldn't have had such a relationship.