1) a = b ⊕ s1

2) b = a ⊕ s1

3) b ⊕ s2 = c

Is there a way to find s1 and s2 if we know many different values of a and c?

4) a1 = b1 ⊕ s1

5) a1 ⊕ s1 ⊕ s2 = c1

I think it is possible if we analysis the result, but I am not sure how. Or is it impossible?

Edit: Sorry , a and c should be known but not b.

Alice sends 'a' to Bob. 2) Bob computes a xor s1 = b then 3) b xor s2 = c. Bob then sends c to Alice and verify if b =c .

  • 1
    $\begingroup$ It's just grade school algebra, treat the $\oplus$ as a regular $+$. $\endgroup$
    – MickLH
    Mar 1, 2017 at 16:22
  • $\begingroup$ Do you know which $a$s are associated with which $b$s in your sampling (with respect to eq 1)? $\endgroup$
    – SEJPM
    Mar 1, 2017 at 16:45
  • $\begingroup$ yes i know i can rearrange the variables, but then s1 and s2 can have many different values, which isn't true in this case. I just wondering if the eavesdropper can use brute force or other thing to find the key. $\endgroup$
    – puppylord
    Mar 1, 2017 at 16:49
  • $\begingroup$ You can treat 1) as Alice sends 'a' to Bob. 2) Bob computes a xor s1 = b then 3) b xor s2 = c. Bob then sends c to Alice and verify if b =c . $\endgroup$
    – puppylord
    Mar 1, 2017 at 16:59
  • $\begingroup$ okay, I think I got it. Thanks all. It seems s2 will always be 0 because b⊕c = s2 if b = c. Is this correct? $\endgroup$
    – puppylord
    Mar 1, 2017 at 17:17

1 Answer 1


The way your question is written, it's hard to tell what you're asking.

The trivial answer to your original question is that, if you only know $a$ and $c$, then you can calculate $s_1 \oplus s_2 = a \oplus b$, but not the individual values $s_1$ and $s_2$; for every $s_1$, there's a corresponding $s_2$ that satisfies the equations, and vice versa. The same holds true even if you know multiple $(a,c)$ pairs calculated using the same $s_1$ and $s_2$, since each such pair will just yield the same value of $s_1 \oplus s_2$, and no other relevant information.

As for the protocol description you edited in, I have no idea what your protocol is supposed to accomplish, and I suspect you've garbled the description somehow. In particular, if Bob indeed computes both $b = a \oplus s_1$ and $c = b \oplus s_2$, and only sends $c$ back to Alice, then the value $b$ plays absolutely no role in the protocol: Bob could equivalently just compute $c = a \oplus s_1 \oplus s_2$ directly. Also, without knowing $b$, Alice cannot possibly verify that $b = c$. Bob could do that, but that's equivalent to just verifying that $s_2 = 0$, which he could just as well check without running the protocol at all. So your protocol, as written, makes no sense.

Anyway, even if the protocol was fixed to actually work, I don't see any way to build a secure authentication protocol out of just linear operations like XOR. You'd need something else, like a block cipher, to do that.

  • $\begingroup$ b is a random challenge number and Alice know b. I guess the question itself have some problem... thank you for your answer $\endgroup$
    – puppylord
    Mar 1, 2017 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.