# Can a message and one time pad each encrypted with separate ciphers be weaker than the stronger of either cipher?

Assume you have:

• A truly random one time pad, $$P$$
• A plain text message, $$M$$
• Two symmetric ciphers, $$C_S$$ and $$C_W$$, where $$C_S$$ is always more secure than $$C_W$$

Assume the keys have already been securely exchanged and the attacker intercepts everything Alice transmits.

In theory, can $$C_S(P \space \oplus \space M)$$ and $$C_W(P)$$ taken together be less secure $$C_S(M)$$?

Also, is $$C_S(P \space \oplus \space M)$$ and $$C_W(P)$$ always more secure than $$C_S(M)$$.

In longer form, if I XOR a message with a one time pad and encrypt that with one cipher and encrypt the one time pad with a different cipher, can that be less secure than just using the stronger of the two ciphers? Is it the case that it would always be stronger?

• Why do you encrypt $P$? What is the purpose? – kelalaka Feb 17 at 18:43
• I'm assuming $C_S(P \space xor \space M)$ with $C_W(P)$ can be more secure than $C_S(P)$ and $P$ together. I don't know if that's the case. – Tyler Spaeth Feb 17 at 18:59
• I don‘t understand: you say the keys are assumed to be exchanged. Then what is P for? Is it used in addition to a key? The weakest part is the key exchange, so this needs to be clear. – not2savvy Feb 18 at 8:07
• I'm not sure it's worth it (having a good source of entropy isn't always easy and processing and transmitting twice the bytes is a pretty big cost). But if it can't be worse, all things being equal it can't hurt and might help, it would be fine to do :-) Mostly curious in the abstract. – Tyler Spaeth Feb 18 at 17:21
• I guess the simplest way to put it is, if $C_S$ is every broken you're still protected by $C_W$ and vice versa. So the attack has to clear two hurdles instead of one. – Tyler Spaeth Feb 18 at 18:02

No, it can cannot be less secure. The proof is simple: if P is ever found out then the security of the strong cipher still protects $$P \oplus M$$ and thus $$M$$.
However if the one-time-pad $$P$$ ever leaks then it can be used to break the weak cipher, and in that case the result is just as secure as the strong cipher. It is generally not a good idea to rely on data to be kept secret forever. And it is certainly not a good idea to rely on security that may or may not be present.
Outside of theoretical security, the weak cipher may also have issues with e.g. padding oracle attacks that could leak $$P$$, in which case only the strong cipher will be left.