This question might be uncannily similiar to this one posted over 6 years ago, but the structure is completely different.
It's written nearly everywhere that OTPs are incapable of sustaining more than their length of data - but I have yet to find an answer besides "reusing them makes cryptanalysis possible" in several different ways.
Suppose Alice and Bob wanted to maintain a OTP-based connection, but are unable to physically exchange entropy besides an initial file. Luckily, Alice has her own entropy source. What Alice and Bob could do is use the initial OTP to send two bits of data at the cost of one bit of entropy. The order of entropy and starting offset could be negotiated beforehand using typical OTP, but let's assume for simplicity's sake that you're sending 2 payload bits in series - and XORing them with an entropy "key" bit, and that the offset Alice picks is also taken from her entropy source.
A meddling Eve, if she knows how this protocol works, could only tell one of two metadata possibilities as a fact:
- that any two linked data bits are the same (ambiguous between
- that any two linked data bits are different (
However, Eve should be unable to determine which of the 2 ambiguous combinations is the correct combination... right? After all, Eve could pick up on patterns of the metadata, but not before Alice and Bob notice.
The data transferred this way (which could be even more entropy - Eve doesn't know which part of the data is which!) would be protected by the initial challenge, and by the entropy of the initial OTP. Knowing all this, we can finally rephrase the question:
Is it possible to perform a cryptanalysis on a hybrid OTP described above, and if it is, what would be an efficient attack vector?
Would it be instead preferable to perform an RSA/Diffie-Hellman key exchange over the initial OTP?