# When we use one time pad TWICE in two different ways

Assumption and Notations: All the values defined over the field $\mathbb{F}_p$, where $p$ is a large prime number. We denote multiplicative inverse of value $v$ by $v^{-1}$. All values are non-zero values.

We all know that one time pad should not be used more than once. Let

• $v_1=b\cdot z$

• $v_2=b+ z^{-1}$

Where $z$ is a uniformly random element of the field and $b$ is a fixed value.

================================================

Question: given $v_1$ and $v_2$ can an adversary learn anything about the values $b$ (and $z$)?

• Yes. ​ The adversary can just solve the system. ​ ​ ​ ​ – user991 Feb 2 '16 at 13:41
• $z = v_2^{-1} ( v_1 + 1)$, $b = v_1 v_2 (v_1 + 1)^{-1}$ – poncho Feb 2 '16 at 14:35
• @poncho Thank you for that. What if we give away $v_1=a\cdot z_1$ and $v_2=b\cdot z_2\cdot (z_1)^{-1}$ to the adversary. Can it learn anything about the values $a$,$b$ (and $z_1$ and$z_2$)? Here $a$ and $b$ are fixed but $z_i$ values are uniformly random values. – user153465 Feb 3 '16 at 12:19

$$v_1 = b \cdot z \\ v_2 = b + z^{-1}$$
$$v_1 \cdot z^{-1} = b \\ v_2 - z^{-1} = b \\ v_1 \cdot z^{-1} = v_2 - z^{-1} \\ v_1 \cdot z^{-1} + z^{-1} = v_2 \\ z^{-1} (v_1 + 1) = v_2 \\ v_1 + 1 = v_2 * z \hspace{50pt} \text{(multiply both side by z)} \\ z = (v_1 + 1) \cdot (v_2)^{-1}$$
Once we find z, we can use the first equation $$v_1 = b \cdot z$$ to find b.
$$v_1 = b \cdot (v_1 + 1) \cdot (v_2)^{-1} \\ b = v_1 \cdot v_2 \cdot (v_1 + 1) ^{-1}$$