Multi-Embedded Xor for Perfect OTP

Question

I am looking for a perfect OTP design, so let's see if this design is good.

There are 2 issues when it comes to a good OTP system, the key and the plaintext, we will use XOR as cypher:

• If the plaintext is like a message, then it should be long enough, otherwise it's pointless. What is the point in encrypting "Hello world", or something like that. So it should be a long message, so that it can't be guessed. If the plaintext is a private key itself, then it should be truly random and long as well, otherwise this scheme is pointless. This has nothing to do with the OTP I will talk about, it's just a caveat.

• The key is the important part. It has to be truly random, the same size as the message or longer, and used only once, hence an OTP (onetime pad). So if we XOR the plaintext with the key, we get an unbreakable OTP.

The weakest link is probably the randomness of the key. However there is a solution:

---

Multi-Embedded Xor

What if we XOR it multiple times with different keys, like this:

$$Cyphertext = ( ( ( ( ( (Plaintext \oplus K1 ) \oplus K2) \oplus K3) \oplus K4) \oplus K5 ) .... \oplus K_n$$

So we would just Xor the plaintext n times with n different one time keys. Even if the key is biased or contains low entropy, the Xor function is known for it's de-biasing features, so Xor-ing multiple keys togeter would decrease the bias, and even for a very low quality random key, I think 5-6 rounds are enough, the bias will definitely shrink after 6 rounds to insignificance. But it also adds entropy into the system. By having 1 weak key with unknown entropy, we can have more keys mixed into the system thus increasing the overall entropy of the keys.

Would this be a perfect OTP design?

Answer 1

What if we XOR it multiple times with different keys, like this: $Cyphertext=((((((Plaintext⊕K1)⊕K2)⊕K3)⊕K4)⊕K5)....⊕Kn$

This is equivalent to XOR with a single key $K$ where $K = K_1 \oplus K_2 \oplus K_3 \oplus ... \oplus K_N$. As such, it would be no stronger than a regular OTP.

Even if the key is biased or contains low entropy, the Xor function is known for it's de-biasing features, so Xor-ing multiple keys togeter would decrease the bias,

This is not accurate: Xor is a bitwise operation, and it only operates on 2 values at a time. The bit at position $i$ in word $K_1$ only interacts with the bit at position $i$ in $K_2$. If a bit at position $i$ happens to be biased, and all of the rest of the bits are not biased, then Xor with similarly biased data will not de-bias any of the other bits in the key word.

Put another one, if the adversary knows that the first bit of each $K$ is $0$, then you can Xor as many $K$ together as you want, and the adversary can still be certain that the first bit will still be $0$.

I think 5-6 rounds are enough, the bias will definitely shrink after 6 rounds to insignificance.

So we can see this is not useful or accurate.

But it also adds entropy into the system. By having 1 weak key with unknown entropy, we can have more keys mixed into the system thus increasing the overall entropy of the keys.

For our purposes, entropy is the number of secret bits of information the adversary does not know and must guess/obtain if they are to evaluate the desired function. So "unknown entropy" is redundant. We assume the secret key to be unknown to the adversary - that is why it is called a secret key.

Now, there are branches of cryptography that focus on retaining security even when some key bits are leaked, but I don't think they focus on the OTP. This is probably because if your key generation process for the OTP is flawed and produces weak keys, then you would be better off using a better key generation process, rather then trying to compensate for the inadequacy further down the line.

Would this be a perfect OTP design?

No; The "perfect" one is the regular old, unmodified OTP, which is information theoretically secure. "More"/"newer"/"complex" is not necessarily better when it comes to cryptography.