# how to get secret keys in xor?

1) a = b ⊕ s1

2) b = a ⊕ s1

3) b ⊕ s2 = c

Is there a way to find s1 and s2 if we know many different values of a and c?

4) a1 = b1 ⊕ s1

5) a1 ⊕ s1 ⊕ s2 = c1

I think it is possible if we analysis the result, but I am not sure how. Or is it impossible?

Edit: Sorry , a and c should be known but not b.

Alice sends 'a' to Bob. 2) Bob computes a xor s1 = b then 3) b xor s2 = c. Bob then sends c to Alice and verify if b =c .

• It's just grade school algebra, treat the $\oplus$ as a regular $+$. – MickLH Mar 1 '17 at 16:22
• Do you know which $a$s are associated with which $b$s in your sampling (with respect to eq 1)? – SEJPM Mar 1 '17 at 16:45
• yes i know i can rearrange the variables, but then s1 and s2 can have many different values, which isn't true in this case. I just wondering if the eavesdropper can use brute force or other thing to find the key. – puppylord Mar 1 '17 at 16:49
• You can treat 1) as Alice sends 'a' to Bob. 2) Bob computes a xor s1 = b then 3) b xor s2 = c. Bob then sends c to Alice and verify if b =c . – puppylord Mar 1 '17 at 16:59
• okay, I think I got it. Thanks all. It seems s2 will always be 0 because b⊕c = s2 if b = c. Is this correct? – puppylord Mar 1 '17 at 17:17

The trivial answer to your original question is that, if you only know $a$ and $c$, then you can calculate $s_1 \oplus s_2 = a \oplus b$, but not the individual values $s_1$ and $s_2$; for every $s_1$, there's a corresponding $s_2$ that satisfies the equations, and vice versa. The same holds true even if you know multiple $(a,c)$ pairs calculated using the same $s_1$ and $s_2$, since each such pair will just yield the same value of $s_1 \oplus s_2$, and no other relevant information.
As for the protocol description you edited in, I have no idea what your protocol is supposed to accomplish, and I suspect you've garbled the description somehow. In particular, if Bob indeed computes both $b = a \oplus s_1$ and $c = b \oplus s_2$, and only sends $c$ back to Alice, then the value $b$ plays absolutely no role in the protocol: Bob could equivalently just compute $c = a \oplus s_1 \oplus s_2$ directly. Also, without knowing $b$, Alice cannot possibly verify that $b = c$. Bob could do that, but that's equivalent to just verifying that $s_2 = 0$, which he could just as well check without running the protocol at all. So your protocol, as written, makes no sense.