I came up with this concept, which I thought would be pretty secure.

So the idea is this, you have a message $M$, which you split up in blocks of each 256 bits. You generate a random (pseudo-random of course) key of $256$ bits. You XOR the first block of $M$ with this key, which is also the input key for the second block, and so on. Would this be a secure scheme? My theory is that since XOR has the property that if you were given

$Z = X \oplus Y$

You can't extract $X$ nor $Y$ from $Z$

So you would have to guess every key in the 256 bit keyspace and go through this "encryption" process and see if you get some logical output.

So, would this be safe?

  • $\begingroup$ @kelalaka what do you mean? $\endgroup$ Nov 22, 2019 at 18:13
  • $\begingroup$ This is auto key cipher.. Right? $\endgroup$
    – kelalaka
    Nov 22, 2019 at 18:14
  • $\begingroup$ I never heard of an autokey cipher, but would the exact process I described be safe? For example encrypting an executable or some certificate $\endgroup$ Nov 22, 2019 at 18:16
  • 3
    $\begingroup$ Any encryption scheme which works (in the sense of allowing decryption with the key), and uses XOR as the only crypto primitive, is insecure. Hint: Ask yourself how you would recognize a message consisting of two blocks of zeros, from one with two blocks of English text, by looking at the ciphertext. This is a break. It goes worse: exploiting redundancy in the plaintext (such as: it contains common works) for key recovery from ciphertext only is an ages-old practice. $\endgroup$
    – fgrieu
    Nov 22, 2019 at 18:30
  • $\begingroup$ Yes, it's a variant of Vigenere. $\endgroup$
    – tylo
    Nov 22, 2019 at 20:53

1 Answer 1


This is a slight variation of the autokey cipher, which was invented by Vigenere, and can be seen as another variant of the Vigenere cipher. The major differences are: It used a different alphabet, the keysize is fixed, and you reuse the ciphertext instead of the key or plaintext.

Therefore, even without looking at the the details, it is fairly obvious that frequency analysis will break it.

Looking closer:

  • if you look at a single block only, it looks like you have an OTP (which would be secure, if you use a truly random and uniform key).
  • However, if we XOR two consecutive blocks $c_{i-1}\oplus c_{i}$, we immediately get the plaintext $m_i$ of that block - because that is just your construction.

So effectively, you only encrypt the first block at all, and anyone can just "decrypt" the other blocks, since the following key is just the previous ciphertext. Of course this has no security at all, unless you limit messages to one block. And then it is just either OTP (if the key is truly random and uniform) or a stream cipher (if the key is generated somehow).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.