Let $k$ by a randomly generated $n$ bit string, and $m$ a $n$ bit message. Then putting $c = m \oplus k$ is the one-time pad and is perfectly secure. Now assume the transmitter and receiver wanted to share more messages: then they could publicly choose a random $n$ bit string $b$, and then by putting $k' = b \oplus k$ they have obtained a new random key, which they can again use to encrypt a new message $m'$ with perfect secrecy.

I am wondering why such a cipher is not used? The only reason I can think of is that if the attacker obtains a single plaintext message, they can decrypt all past and future messages which is clearly not good, and thus the reason it is not used. Are there any other reasons I am missing?

Further, couldn't this be used to create a random bit generator? That is, the seed is a random $n$ bit string, and the publicly known generator will XOR $k$ random but publicly known $n$ bit strings with the seed $k$, to generate a random sequence of length $kn$. Naturally, the reason I am assuming this is not a good random number generator is that, again, if the attacker learns the internal state they can obtain all past and future bits. Are there any other reasons this is not good?

  • 1
    $\begingroup$ Since the crib and dragging will work. Just x-or two messages and see! $\endgroup$ – kelalaka May 22 at 18:19

As @kelalaka pointed out OTP is not “differentially secure”. In addition it has the property, like all additive ciphers which work by modular addition of a keystream, that the keystream and the plaintext have symmetric roles.

What I mean is your suggestion to add the string $b$ to the key $k$ is essentially equivalent to the weakness resulting from reusing plaintext as in VENONA.

The constant $b$ is visible to differential attacks, such as crib dragging. In this case, it is the keystream that is differentially deficient.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.