It is well-known that the two-time pad is very insecure. However, it seems unexploitable in the case where the plaintext is indistinguishable from random (ex. symmetric keys).

Is this property useful?

Note: I don't plan on using this in production.

  • $\begingroup$ easiest way to mitigate is compressing the input before x-or. $\endgroup$ – kelalaka Jan 27 '16 at 10:58
  • 2
    $\begingroup$ @kelalaka: if the input plaintext is indistinguishable from random, compression doesn't work. In fact, many compression algorithms would detect that the compression algorithm is actually expanding the text, and drop back to a 'output the plaintext as-is' mode $\endgroup$ – poncho Jan 27 '16 at 14:49
  • 1
    $\begingroup$ On a side note, you could ask; why would you want to send a uniformly random symmetric key using OTP (or two time pad)? If you are already sharing a uniformly random key for OTP, then in many cases you can probably use this shared randomness to do whatever it is you need to do. $\endgroup$ – Guut Boy Jan 27 '16 at 14:56

By two-time pad I assume you mean using a one time pad key to encrypt two messages. Lets say $K$ is the key and $m_1, m_2$ are your messages. Then from the ciphertexts $c_1 = m_1 \oplus K$ and $c_2 = m_2 \oplus K$ an adversary could trivially learn information such as $x = c_1 \oplus c_2 = m_1 \oplus m_2$. Whether or not this information is "exploitable" may be application specific (in general it is very hard to say what "exploitable" should mean). However, the fact is that you are leaking information on your secret messages and you should be very careful.

Take the following example of how this could go very wrong: Say I want to send two random 128 bit strings $m_1$ and $m_2$ to a friend who should then use $x = m_1 \oplus m_2$ as an AES key. If I send $m_1$ and $m_2$ using regular OTP then there is no problem. Using the two-time pad, as described above, the AES key is revealed.

  • 5
    $\begingroup$ The other standard objection to two-time pad is that if the attacker somehow learns $m_1$, he then gets $m_2$ for free. $\endgroup$ – poncho Jan 27 '16 at 14:44
  • $\begingroup$ Yes, that would be an other good example of how it may go wrong. $\endgroup$ – Guut Boy Jan 27 '16 at 14:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.