# Can I use a key twice if the message is longer than the key in one-time pad?

I have a key for a one-time pad. Its length is 512, and I have a message to encrypt whose length is 600. Can I reuse the first 88 chars of the key to encrypt the end of the message?

The key is still random, so it should be still secure, right? If it isn't secure, why not?

• no you should never reuse the OTP key. In your case, the 88 bytes of the key will be reused so these 88 bytes can get compromise. see this question for more detail crypto.stackexchange.com/questions/59/… – abraza Dec 23 '17 at 17:21
• I want to emphasize that these aren't just theoretical weaknesses. For example, if an attack only knows "the message is ASCII encoded English" that will be enough to mostly recover the parts encrypted by the reused key. – CodesInChaos Dec 24 '17 at 10:10
• If you use any part of the pad more than once, it's not a One Time Pad. The name already holds the answer! – e-sushi Dec 24 '17 at 16:31

$\text{KnownBytes} \oplus k_{1-20} \mathbin\Vert \text{Something} \oplus k_{21-512} \mathbin\Vert \text{Bytes1} \oplus k_{1-20} \mathbin\Vert \text{Bytes2} \oplus k_{21-88}$
where $k$ is the key
Given this, we can recover the value $\text{Bytes1}$ simply by $\text{KnownBytes} \oplus k_{1-20} \oplus \text{Bytes1} \oplus k_{1-20} = \text{KnownBytes} \oplus \text{Bytes1}$. Since you know $\text{KnownBytes}$ you can then compute $\text{Bytes1}$.
It gets worse. You've also reused key bytes 21 through 88. Just because the attacker doesn't know the value of $\text{Bytes2}$ or the first few bytes of $\text{Something}$ doesn't make it secure. The two ciphertexts can be xored to remove the key and yield the xor of the underlying plaintext.