I'll start off by saying I am not looking for solutions here, just suggestions on how to proceed. I am given a short list of ciphertexts (20something) and I know that one of the ciphertexts has been encrypted with the same key.

I know that once I identify the ciphertext, I will do a crib drag attack, but my issue is with finding the ciphertext in the first place. Are there any suggestions as to how to approach this issue? All similar questions I could find online dealt with a list of ciphertexts that were all encrypted with the same key, which is much simpler to tackle.

The only thing I know about the plaintexts is that they are all in English. I could do all the possible XOR combinations and crib drag every single one of them but that seems terribly inefficient and not the correct way to go about it. Any suggestions are appreciated.

Update: Unless I've misunderstood what Meir Maor meant (I couldn't find anything on "char level histogram"). I don't see how a frequency chart would help in this case, considering that only the key is the same between the 2 messages in a list of over 20.

  • $\begingroup$ A char level(or char-gram) histogram should be sufficient to identify the pair. $\endgroup$
    – Meir Maor
    Commented Nov 12, 2017 at 20:20
  • $\begingroup$ Is a char level histogram just a frequency plot of each character(or in this case ,a hex pair)? $\endgroup$
    – Matic
    Commented Nov 12, 2017 at 21:19

1 Answer 1


If you assume the keys are random yet the plain text are english. Xoring two cipher texts with different keys will look like random noise. Yet if you xor two messages with same key you get a complex distribution of pairs of English messages, very not random. A simple histogram should be sufficient to tell the distributions apart. If the keys are not random(possibly leading to other attacks) you will probably still be able to pull off the same attack though you will need to study the histogram of xoring English messages so you can detect it. With random keys it won't even be necessary.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.