# Is “reused one time pad” safe to encrypt a message like “random number + mod”?

I want to encrypt a message that contains a fixed length random number and a long mod. i.e. 1234564284 (created like this 123456 + (123456 mod 9931))

I assume that reusing the same key is not a problem if the message is purely random but is the fact that the message is always given with a mod is opening a hole to find the key?

• I don't understand your question. You have 2 numbers and a modulus. You cannot add by the mod operator, that doesn't make any sense. – mikeazo Mar 25 '16 at 23:42
• Reusing a one time pad's key is very much a problem. – Bardi Harborow Mar 26 '16 at 9:27
• @mikeazo: the message i want to encrypt is : "1234564284". this number is composed of a random number "123456" concatenated with 123456 mod 9931 = "4284". – hey_monkey Mar 26 '16 at 12:06
• Let me make sure I understand, the algorithm for encryption of $m$ is to take $m+(m\bmod{n})$ where $n$ is the secret key. How do you then decrypt, given only a ciphertext $c$ and $n$? – mikeazo Mar 26 '16 at 12:29
• not exactly. Alice want to send m (a random number) to Bob. To make sure that after decryption bob can verify that it is a valid number Alice add to m the m mod n. So the complete message is m+(m mod n). The secret key is a random key fixed and known by alice and bob. – hey_monkey Mar 26 '16 at 12:43

Here's my understanding of the encryption process you're talking about:

• You take a random number $r$, and compute $t = r \bmod n$

• You concatinate the two numbers $r$ and $t$, and express the concatination as a bitstring $u$

• You then xor that bitstring $u$ with a secret bitstring $s$

You do the same for two different random numbers $r$ and $r'$, using the same values for $n$ and $s$.

If that is correct, then here is one way that someone with the two encrypted strings can recover a short list of possible $r, r'$ values:

• Consider all possible $r$ values (in your example, $r$ was a 6 digit number, so that would be trivial; I don't know how long you would make $r$ in the real case)

• For each such $r$, compute the corresponding $t = r \bmod n$, and combine them to form the bitstring $u$.

• Exclusive-or $u$ with the first ciphertext to create the corresponding bitstring $s$.

• Validate that guess on $s$ by attempting to decrypt the second ciphertext with it; recovering the corresponding $r'$, $t'$ values. If $t' = r' \bmod n$, then add $r, r'$ to the list of plausible values.

In the simple example you gave (and depending somewhat on how you encode the numbers as bitstrings), that would give you a list of approximately 100 $r, r'$ values, one of which are the correct one. It would be possible to list this to only the correct value given 1 or 2 more ciphertexts.

One time pad (where you use the secret bitstring $s$ only once) is safe because, while can reconstruct the possible values of $s$ (based on what the original message might be), you have no way to verify any possible $s$ value. By reusing $s$, you provide such a way, and thus lose the security guarantees that you have when you use $s$ only once.

It is likely possible to design a more efficient attack method; however that method would likely depend on the details of how you encode an integer as a bitstring

• Thank you, very helpfull. In my real case "r" will be a 36bits string and "t" a 13bits string. And actually my main problem is if the key "s" is found but finding the right r,r' is finding the right s. – hey_monkey Mar 26 '16 at 20:54
• @hey_monkey: in that case, I would advise you to either use a conventional nondetermanistic encryption method (say, GCM with a random nonce; if this case, you can drop the mod checksum), or (if you are limited in the size of the ciphertext you can handle) you use a Format Preserving Encryption method (in which case you can simply replace the mod with a fixed 0000 sequence) – poncho Mar 26 '16 at 20:59