I have just learned about the OTP, how it uses XOR, and how it's secure if the keys are random.

But what will happen when the same plaintext is used again with a new key?

$c_1 = k_1 ⊕ p$

$c_2 = k_2 ⊕ p$

$c_3 = k_3 ⊕ p$

$c_n = k_n ⊕ p$

Is this secure?

  • 1
    $\begingroup$ Secure in what sense? As in, it doesn't reveal the plaintext? Or are you expecting something more? $\endgroup$ Jun 13, 2019 at 19:20
  • $\begingroup$ @Ilmari Karonen secure in the present of MITM, which can store the ciphertexts. $\endgroup$
    – Cryp7o
    Jun 16, 2019 at 6:28
  • 1
    $\begingroup$ Well, OTP does not protect message integrity anyway, so an MITM can always modify the message(s) e.g. by flipping arbitrary bits. Or do you just want confidentiality? $\endgroup$ Jun 16, 2019 at 11:39

2 Answers 2


If the keys are all independent and near-uniform random, then an chosen-plaintext attacker has near-zero advantage in the IND-CPA game.

In the IND-CPA game, the attacker can ask for the ciphertexts of any plaintexts of their choice (CPA, Chosen-Plaintext Attack), and then submits two challenge messages, and, given the ciphertext for one of challenge messages, wins the game if they can tell which one (IND for indistinguishability). The attacker's advantage is their probability above 1/2 of winning this game. This is the standard notion of security for an unauthenticated cipher.

Of course, this only thwarts an eavesdropper who can listen but not touch the messages. A MITM could easily transform one ciphertext into another, forging messages without raising any alarms, even if they can't learn anything about the plaintext given the ciphertext—they may know a priori what the plaintext will be and may want to replace it by something else.

So this is usually not enough security for applications that involve, say, the internet: you need an authenticated cipher for that, for example a one-time pad with a one-time authenticator appended, which is the model that AES-GCM and NaCl crypto_secretbox_xsalsa20poly1305 make practical with short keys expanded pseudorandomly into message-length pads.

  • $\begingroup$ Would the downvoter care to explain what they disagreed with in this answer? $\endgroup$ Jun 17, 2019 at 14:05

If your one-time-pad key was generated in a truly random manner--which is a big "if"--and your key was at least as long as the message; if it was protected against any compromise; and it was only used once on one message--then that message is secure in the sense of it being confidential.

Known plaintext, knowing the exact length of the message, knowing the language of the message, knowing whether some kind of complex transposition or simple rearrangement was used, and how, (i.e. Russian Copulation) still does not help the attacker break the ciphertext.

That is not to say that everything is now cast-iron secure. Where is the authentication and proof of message integrity?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.