# basic question regarding two-time pad attack

Dan Boneh's Crypto 1 Course includes a lesson on stream ciphers with the following slide:

And the answer he gives is $$m \oplus p$$, which is why this is insecure.

But I don't see why this is correct.

If:

• $$m = 0011$$
• $$k = 1100$$
• $$p = 1010$$

then $$m \oplus k = 1111$$

and $$(m \oplus k) \oplus p = 0101$$

and $$m \oplus p = 1001$$

so $$m \oplus p \neq ((m \oplus k) \oplus p)$$

What am I doing wrong in the above?

This is not the two-time pad attack this is the malleability of the OTP or any stream cipher. Malleability means that the active attacker can change the ciphertext into another ciphertext that can be decrypted without any error during the decryption. That is why we need integrity and authentication.

How it works; you sent $$m\oplus k$$ on the communication channel, the active attacker captures (and probably stops, too) and modifies the ciphertext with $$p$$ then the message is $$m \oplus k \oplus p$$, when the receiver decrypted with key $$k$$ they will get the modified message $$m \oplus p$$. This can be very dangerous if the message is known or the format of it known. For example, the attacker can turn Attack at the noon! to Attack at the moon!

For the last equation;

$$m \oplus p \neq (m \oplus k) \oplus p$$

This is what we expected except $$k=0$$.

• great explanation, thanks! – David J. Mar 10 at 17:17
• the two texts in the example are different lengths (one extra character in the manipulated output. Is that possible in this specific context? – user30713 Mar 14 at 11:43
• @sitaram It was a typo, thank you for the notice. It is not much possible since the attacker has no knowledge of the keystream. You have 1/256 chance that it is the desired char if the length information is not sent. – kelalaka Mar 14 at 11:47