What would be the proper order of operations for OTP encryption/decryption when using subtraction and mod 10? E.g. P - K = C or K - P = C

Most of the sources I have seen do not cover this topic or I didn't grasp the principles behind this encryption well enough. From what I gather it shouldn't matter as long as the pad key numbers (K) are truly random.

For instance:

OTP PAD(-): 47757
CIPHER:     28760 

EDIT: From some tests I see that. When used for encryption, whether P + K or K + P to decrypt the original message you need to do C - K, otherwise K - C will not return P. When used for encryption, P - K since C + K will return P, otherwise K + C will not return the original plaincode.

Can someone please explain whether using subtraction or addition for encryption one has a security advantage over the other.

  • $\begingroup$ Why the subtraction? The common and most intuitive method is addition for encryption, and subtraction only for decryption. Irrelevant from a security perspective, but perhaps a little easier on the brain. Have you seen users.telenet.be/d.rijmenants/en/onetimepad.htm? Probably the best resource on OTPs anywhere. $\endgroup$
    – Paul Uszak
    Commented Jul 21, 2021 at 12:08
  • $\begingroup$ Hey. I did yeah. It is a really the best resource out there, but I didn't find an answer to my question there (I might have missed it). I just wanted to better understand the different variants of the OTP encryption and whether they are equal in terms of encryption strength. $\endgroup$
    – SubXi
    Commented Jul 21, 2021 at 13:59

1 Answer 1


I advocate for $K-P\to C$ and $K-C\to P$ so that encryption and decryption are identical, as in the binary OTP. Each digit is processed modulo 10.

    OTP PAD K:  47757            OTP PAD K:  47757
  - PLAINTEXT:  65417          - CIPHERTEXT: 82340 
    -----------------            -----------------
  = CIPHERTEXT: 82340          = PLAINTEXT:  65417

Update: from functionality and security perspectives, $P-K\to C$ and $C+K\to P$ is perfectly fine; as well as $P+K\to C$ and $C-K\to P$. What I advocate has a single benefit: the same method/code is used for encryption and decryption.

The reason these three variants allow decryption and are perfectly secure is the same: the set $\{0,1,2,3,4,5,6,7,8,9\}$ is a group under addition modulo $10$ (if the group is not commutative, we need to change $K-C\to P$ into $(-C)+K\to P$ ). Therefore, there is nothing to learn about $P$ from $C$ when not knowing $K$.

  • $\begingroup$ What about when different operations are performed for both encryption (P - K = C) and decryption (C + K = P). Is there any benefit using one over the other? $\endgroup$
    – SubXi
    Commented Jul 21, 2021 at 9:48
  • $\begingroup$ Hey, thanks for the explanation! Makes perfect sense. $\endgroup$
    – SubXi
    Commented Jul 21, 2021 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.