Assume you have:

  • A truly random one time pad, $P$
  • A plain text message, $M$
  • Two symmetric ciphers, $C_S$ and $C_W$, where $C_S$ is always more secure than $C_W$

Assume the keys have already been securely exchanged and the attacker intercepts everything Alice transmits.

In theory, can $C_S(P \space \oplus \space M)$ and $C_W(P)$ taken together be less secure $C_S(M)$?

Also, is $C_S(P \space \oplus \space M)$ and $C_W(P)$ always more secure than $C_S(M)$.

In longer form, if I XOR a message with a one time pad and encrypt that with one cipher and encrypt the one time pad with a different cipher, can that be less secure than just using the stronger of the two ciphers? Is it the case that it would always be stronger?

  • $\begingroup$ Why do you encrypt $P$? What is the purpose? $\endgroup$ – kelalaka Feb 17 '20 at 18:43
  • $\begingroup$ I'm assuming $C_S(P \space xor \space M)$ with $C_W(P)$ can be more secure than $C_S(P)$ and $P$ together. I don't know if that's the case. $\endgroup$ – Tyler Spaeth Feb 17 '20 at 18:59
  • $\begingroup$ I don‘t understand: you say the keys are assumed to be exchanged. Then what is P for? Is it used in addition to a key? The weakest part is the key exchange, so this needs to be clear. $\endgroup$ – not2savvy Feb 18 '20 at 8:07
  • $\begingroup$ I'm not sure it's worth it (having a good source of entropy isn't always easy and processing and transmitting twice the bytes is a pretty big cost). But if it can't be worse, all things being equal it can't hurt and might help, it would be fine to do :-) Mostly curious in the abstract. $\endgroup$ – Tyler Spaeth Feb 18 '20 at 17:21
  • $\begingroup$ I guess the simplest way to put it is, if $C_S$ is every broken you're still protected by $C_W$ and vice versa. So the attack has to clear two hurdles instead of one. $\endgroup$ – Tyler Spaeth Feb 18 '20 at 18:02

No, it can cannot be less secure. The proof is simple: if P is ever found out then the security of the strong cipher still protects $P \oplus M$ and thus $M$.

However if the one-time-pad $P$ ever leaks then it can be used to break the weak cipher, and in that case the result is just as secure as the strong cipher. It is generally not a good idea to rely on data to be kept secret forever. And it is certainly not a good idea to rely on security that may or may not be present.

Outside of theoretical security, the weak cipher may also have issues with e.g. padding oracle attacks that could leak $P$, in which case only the strong cipher will be left.

All in all, without additional details, I would rate this about as secure as the strong cipher, so the one time pad doesn't seem to have much benefit (certainly compared to, for instance, frequently using fresh keys).

  • $\begingroup$ My thought was you never know the real strength of a symmetric key system for sure. So if you use two different ciphers you at least get the stronger of the two. So in theory, at worst you get no additional security and at best you get the stronger of the two ciphers even though you might not know which one that is. So at the cost of finding a good source of entropy and transmitting more information, you get potentially safer transmission. $\endgroup$ – Tyler Spaeth Feb 18 '20 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.