I am pretty new to the cryptography scene but I wanted to know if it is possible to use crib dragging on cipher text which doesn't contain words? This data would be encrypted using the same key with a one time pad and the data is encoded using base64 before it is encrypted.

For example,

  • key = [1, 2, 3, 4]
  • message1 = [C, B, D, K]
  • message2 = [H, K, L, U]
  • encryptedMessage1 = [D, D, G, O]
  • encryptedMessage2 = [I, M, O, Y]

(yes I know this isn't exactly base64)

So if we XOR these two encrypted messages together we may or may not get CBDK or HKLU based on the word used for cribbing and even if we do get one how can you verify that it is the correct message?

Again total noob and trying to teach myself. ;)

  • $\begingroup$ If multiple messages are xor'ed with the same key (key reuse) and an attacker can figure out one message he will know the key and can decrypt all other messages. This is the problem with such a system and why in such a system the key must never be used a second time. Prior Base64 encoding will not help in this scenario. $\endgroup$
    – zaph
    Nov 6, 2018 at 7:50

2 Answers 2


Yes, it is possible to use crib dragging. It is easy to prove this: you could just search for the base 64 encoded version of the crib. This would work even if you would simply use search for a recurrence of the crib every 4 characters because that's the amount of base 64 characters that are needed to encode 4 bytes. So the chance of success would be diminished, but it is still possible.

It is also possible to perform crib dragging over byte boundaries in base 64, but then you may need to check for multiple possibilities that could be valid. So the chance of success is much lower if you start in the middle of a base 64 character.

You can of course guess the characters before the crib itself as well, so the extended crib can still be moved across the boundaries. You'd need to guess up to 3 characters though.

  • $\begingroup$ In fact, you can do quite a lot just based on the fact that the upper bits of ASCII text bytes have very little variation. I recently wrote an answer to another question here that goes into more detail on that. And similar methods can also be extended to e.g. non-ASCII text in the UTF-8 encoding, which also has quite a bit of structure in the high bits. $\endgroup$ Nov 6, 2018 at 17:16
  • $\begingroup$ True, you can weed out a lot of possible keys that way (any keys that result in a high bit of plaintext set to 1 at the very least), and during crib dragging a lot of options are immediately ruled out. Of course the fact that you need more key material in the first place should be offset to that, negating any possible advantage to an attacker. $\endgroup$
    – Maarten Bodewes
    Nov 6, 2018 at 17:26

No, it's really not base64 encoding :) If the key length is egal to the text, it's an one time pad encryption

how can you verify that it is the correct message?

To answer your question, you can add for example at the begining of the message the sha-md5-crc32 hash of the clear text. The hash would be of course also encrypted.

@Stephen Collins: as the name implies, OTP is only used once. The mask is used only to decrypt a given message and cannot decrypt any other one. Xor gives an offset value to a specific character, if you use this same value on another character it will return you anything.

  • $\begingroup$ Okay I agree with this. But let’s say I have 2 different plaintext messages which contain no words but just random sequences of ascii symbols. If I use a OTP to encrypt both messages using the same key would it be possible to recover both of these random sequences without knowing this key? From further research it appears that methods such as crib dragging require the underlying message in the cipher text to contain words of a specific language. $\endgroup$ Nov 6, 2018 at 2:56
  • $\begingroup$ If you reuse a key in such a method by definition is is not a OTP since it is reused. $\endgroup$
    – zaph
    Nov 6, 2018 at 7:52
  • 1
    $\begingroup$ This answer negates the assumptions made in the question. It has been made clear that the plaintext is base 64 encoded before encryption and yes, the example clearly shows that the OTP is reused (making it a many-time-pad, if that kind of term juggling is required). $\endgroup$
    – Maarten Bodewes
    Nov 6, 2018 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.