# Is one time pad cipher reuse and random key secure?

The sender and receiver share two different secret keys: s1 and s2 both y bit values. 'x' is a randomly generated y bit value. The reader sends to the tag a challenge y = x ⊕ s1, and the receiver responds with z = x ⊕ s2 after recovering x = y ⊕ s1.

s1 and s2 never change, x is randomly generated each complete transaction. Can you determine s1 and s2 through a single transaction? After multiple?

• It would be better if you call it one-time-tag. – kelalaka Mar 7 '19 at 7:15

If your goal is to ensure only the legitimate sender with knowledge of $$s_1$$ and $$s_2$$ can answer the challenge, then this protocol fails to achieve your goal: eavesdropping a single challenge/response pair $$(y, z)$$ is enough to forge any number of subsequent responses pairs with the same $$s_1$$ and $$s_2$$.

Specifically, $$z = y \oplus s_1 \oplus s_2$$, so to forge the correct response $$z' = x' \oplus s_2$$ to a subsequent challenge $$y' = x' \oplus s_1$$ it suffices to recover $$s_1 \oplus s_2 = z \oplus y$$ and then to compute $$z' = y' \oplus s_1 \oplus s_2 = x' \oplus s_1 \oplus s_1 \oplus s_2 = x' \oplus s_2$$ as expected.

If each $$x$$ is independently uniformly distributed, then you can't recover $$s_1$$ or $$s_2$$ from it (effectively, you have encrypted $$s_1$$ with the one-time pad $$x$$ in this scenario!), but seldom is the pad the object you're interested in protecting in the end!

So what are you really trying to accomplish here?

• I guess it come down to if there is cipher text reuse (But not key reuse) then is the one time pad secure - to which I believe it is as long the key is truely random – Dartuso Mar 7 '19 at 4:15

Squeamish Ossifrage gave a clear explanation on how to forge responses, it is perhape worth elaborating why you can not recover s1 or s2. We can recover s1^s2 as explained (s1^x)^(s2^x)=s1^s2 , so we will ask if we can discover s1, also discovering s2.

Given any transaction, every possible value for s1 corresponds to some possible value for x. So if x is uniform ly random every possible value of s1 is equally likely.

A second transaction will only tell us the difference between the x values, it will not give us any more information on s1 nor s2.