Two-Time Pad

XOR two messages that were encrypted with the same pad. The key cancels out, and both messages are still there.

CryptanalysisKey reusedemo

Objectives

Show that C1 xor C2 equals P1 xor P2 and contains no key at all.
Drag a crib along the combined stream and recover text from both messages.
Connect the same failure to VENONA, WEP, and a repeated AES-GCM nonce.

33%

C₁ ⊕ C₂ = P₁ ⊕ P₂. No key is left, and both plaintexts are still in there.

Message 1

Message 2

One pad, fixed, used for both. That is the only mistake in this section, and it is the mistake VENONA, WEP and every repeated AES-GCM nonce are made of.

C₁ = P₁ ⊕ K

72E44D08C236CF34926515A8F11327BD45E817258F39C805B62ED764399C

C₂ = P₂ ⊕ K

6CE44618C223D351E66615D1E0612CA022EE78318950C01ED234D1673091

C₁ ⊕ C₂ = P₁ ⊕ P₂: the key cancels and is gone

1E000B1000151C657403007911720B1D67066F140669081B641A0603090D

Drag a crib along it

Crib: a word you think is in one of them

Offset

crib ⊕ (C₁ ⊕ C₂) at that offset

AT T

No key is involved anywhere in that line. At the right offset the crib cancels one message and what comes back is the other one, so a hit is “this reads as English”, not “this key worked”.

Every offset that reads as text

offset 4	" AT T"
offset 7	"E KEY"

Guess a word in one message, read it out of the other, then alternate. Both fall together, and neither one was ever weak: the one-time pad is the only unconditionally secure cipher on this site. It was the key management that failed. One rule holds across VENONA, WEP and AES-GCM: a keystream is used once.

step 1/3

CPE 645 / CS 685

Two-Time Pad

Breaking Autokey

Breaking the Rail Fence