-1
$\begingroup$

Assumption and Notations: All the values defined over the field $\mathbb{F}_p$, where $p$ is a large prime number. We denote multiplicative inverse of value $v$ by $v^{-1}$. All values are non-zero values.


We all know that one time pad should not be used more than once. Let

  • $v_1=b\cdot z$

  • $v_2=b+ z^{-1}$

Where $z$ is a uniformly random element of the field and $b$ is a fixed value.

================================================

Question: given $v_1$ and $v_2$ can an adversary learn anything about the values $b$ (and $z$)?

$\endgroup$
  • 3
    $\begingroup$ Yes. ​ The adversary can just solve the system. ​ ​ ​ ​ $\endgroup$ – user991 Feb 2 '16 at 13:41
  • 3
    $\begingroup$ $z = v_2^{-1} ( v_1 + 1)$, $b = v_1 v_2 (v_1 + 1)^{-1}$ $\endgroup$ – poncho Feb 2 '16 at 14:35
  • $\begingroup$ @poncho Thank you for that. What if we give away $v_1=a\cdot z_1$ and $v_2=b\cdot z_2\cdot (z_1)^{-1}$ to the adversary. Can it learn anything about the values $a$,$b$ (and $z_1$ and$z_2$)? Here $a$ and $b$ are fixed but $z_i$ values are uniformly random values. $\endgroup$ – user153465 Feb 3 '16 at 12:19
0
$\begingroup$

$ v_1 = b \cdot z \\ v_2 = b + z^{-1} $

Given the following equations, we can rearrange the following into:

$ v_1 \cdot z^{-1} = b \\ v_2 - z^{-1} = b \\ v_1 \cdot z^{-1} = v_2 - z^{-1} \\ v_1 \cdot z^{-1} + z^{-1} = v_2 \\ z^{-1} (v_1 + 1) = v_2 \\ v_1 + 1 = v_2 * z \hspace{50pt} \text{(multiply both side by z)} \\ z = (v_1 + 1) \cdot (v_2)^{-1}$

Once we find z, we can use the first equation $ v_1 = b \cdot z $ to find b.

$ v_1 = b \cdot (v_1 + 1) \cdot (v_2)^{-1} \\ b = v_1 \cdot v_2 \cdot (v_1 + 1) ^{-1}$

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.