0
$\begingroup$

I have a key for a one-time pad. Its length is 512, and I have a message to encrypt whose length is 600. Can I reuse the first 88 chars of the key to encrypt the end of the message?

The key is still random, so it should be still secure, right? If it isn't secure, why not?

Improve this question
$\endgroup$
3
  • $\begingroup$ no you should never reuse the OTP key. In your case, the 88 bytes of the key will be reused so these 88 bytes can get compromise. see this question for more detail crypto.stackexchange.com/questions/59/… $\endgroup$
    – crypt
    Dec 23, 2017 at 17:21
  • $\begingroup$ I want to emphasize that these aren't just theoretical weaknesses. For example, if an attack only knows "the message is ASCII encoded English" that will be enough to mostly recover the parts encrypted by the reused key. $\endgroup$
    – CodesInChaos
    Dec 24, 2017 at 10:10
  • 1
    $\begingroup$ If you use any part of the pad more than once, it's not a One Time Pad. The name already holds the answer! $\endgroup$
    – e-sushi
    Dec 24, 2017 at 16:31

1 Answer 1

Reset to default
4
$\begingroup$

Re-using the key of a one time pad in a cycle makes your cipher a Vigenère cipher - it is no longer a one time pad.

This scheme is weak for lots of reasons. The easiest example is with known plaintext. Let's pretend your scheme is used to encrypt packet data. Chances are, the first 20 bytes are known or easy to guess packet header bytes so we have:

$ \text{KnownBytes} \oplus k_{1-20} \mathbin\Vert \text{Something} \oplus k_{21-512} \mathbin\Vert \text{Bytes1} \oplus k_{1-20} \mathbin\Vert \text{Bytes2} \oplus k_{21-88} $

where $k$ is the key

Given this, we can recover the value $\text{Bytes1}$ simply by $\text{KnownBytes} \oplus k_{1-20} \oplus \text{Bytes1} \oplus k_{1-20} = \text{KnownBytes} \oplus \text{Bytes1}$. Since you know $\text{KnownBytes}$ you can then compute $\text{Bytes1}$.

It gets worse. You've also reused key bytes 21 through 88. Just because the attacker doesn't know the value of $\text{Bytes2}$ or the first few bytes of $\text{Something}$ doesn't make it secure. The two ciphertexts can be xored to remove the key and yield the xor of the underlying plaintext.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.