The sender and receiver share two different secret keys: s1 and s2 both y bit values. 'x' is a randomly generated y bit value. The reader sends to the tag a challenge y = x ⊕ s1, and the receiver responds with z = x ⊕ s2 after recovering x = y ⊕ s1.

s1 and s2 never change, x is randomly generated each complete transaction. Can you determine s1 and s2 through a single transaction? After multiple?

  • $\begingroup$ It would be better if you call it one-time-tag. $\endgroup$ – kelalaka Mar 7 '19 at 7:15

If your goal is to ensure only the legitimate sender with knowledge of $s_1$ and $s_2$ can answer the challenge, then this protocol fails to achieve your goal: eavesdropping a single challenge/response pair $(y, z)$ is enough to forge any number of subsequent responses pairs with the same $s_1$ and $s_2$.

Specifically, $z = y \oplus s_1 \oplus s_2$, so to forge the correct response $z' = x' \oplus s_2$ to a subsequent challenge $y' = x' \oplus s_1$ it suffices to recover $s_1 \oplus s_2 = z \oplus y$ and then to compute $$z' = y' \oplus s_1 \oplus s_2 = x' \oplus s_1 \oplus s_1 \oplus s_2 = x' \oplus s_2$$ as expected.

If each $x$ is independently uniformly distributed, then you can't recover $s_1$ or $s_2$ from it (effectively, you have encrypted $s_1$ with the one-time pad $x$ in this scenario!), but seldom is the pad the object you're interested in protecting in the end!

So what are you really trying to accomplish here?

  • $\begingroup$ I guess it come down to if there is cipher text reuse (But not key reuse) then is the one time pad secure - to which I believe it is as long the key is truely random $\endgroup$ – Dartuso Mar 7 '19 at 4:15

Squeamish Ossifrage gave a clear explanation on how to forge responses, it is perhape worth elaborating why you can not recover s1 or s2. We can recover s1^s2 as explained (s1^x)^(s2^x)=s1^s2 , so we will ask if we can discover s1, also discovering s2.

Given any transaction, every possible value for s1 corresponds to some possible value for x. So if x is uniform ly random every possible value of s1 is equally likely.

A second transaction will only tell us the difference between the x values, it will not give us any more information on s1 nor s2.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.