Is this a scenario where reuse of a One Time Pad is acceptable?

Question

I require an encryption algorithm that requires two parties with two different keys to be able to decrypt it. I could double AES encrypt, but I am instead considering AES encryption followed by a OTP since 1) I would like to hedge against the unlikely possibility of an AES exploit and 2) as the information being encrypted is critical, I like the perfect encryption of a OTP.

Since the data encrypted by the OTP is AES ciphertext with random IV's, which ostensibly is a stream of random data, having multiple ciphertexts encrypted by the same OTP should provide very little advantage to an attacker, correct?

Finally, if it matters for purpose of this question, the ciphertext will be updated many times over the years, but only upon one event will it be deciphered into plaintext, at which point the OTP can be discarded.

Answer 1

According to the current setup, the OTP offers no security under the assumption of unbounded adversary; and OTP is redundant under the standard assumptions we make for AES-based ciphers.

Answer 2

Reusing a one-time pad key leaks the xor of the plaintexts. In your case, the OTP plaintexts are AES ciphertexts.

I would like to hedge against the unlikely possibility of an AES exploit

If this unlikely attack on AES required the attacker to know only the xor of two ciphertexts, then your OTP would do nothing to stop it.

If your threat model includes possible future attacks on AES, then I would suggest the following alternative:

Secret share your secret message in an $n$-out-of-$n$ secret sharing scheme. Encrypt each share with a different key and completely different encryption scheme. Now even if an attacker can break $n-1$ of those schemes eventually, they still get no information about your secret message.

(This kind of construction, where you build something from $n$ components, and the overall scheme is secure if any one of its components is secure, is called a "combiner.")