Introduction to Cryptography with Coding Theory, 3rd Edition

4.3 Multiple Use of a One-Time Pad

Alice sends messages to Bob, Carla, and Dante. She encrypts each message with a one-time pad, but she’s lazy and uses the same key for each message. In this section, we’ll show how Eve can decrypt all three messages.

Suppose the messages are $M_1\text{,}{M}_2\text{,}{M}_3$ and the key is $K$. The ciphertexts $C_1\text{,}{C}_2\text{,}{C}_3$ are computed as $M_i\oplus K=C_i$. Eve computes

$$C_1\oplus C_2=(M_1\oplus K)\oplus (M_2\oplus K)=M_1\oplus M_2\text{.}$$

Similarly, she obtains $M_1\oplus M_3=C_1\oplus C_3$ and $M_2\oplus M_3=C_2\oplus C_3$. The key $K$ has disappeared, and Eve’s task is to deduce $M_1\text{,}{M}_2\text{,}{M}_3$ from knowledge of $M_1\oplus M_2$, $M_1\oplus M_3$, $M_2\oplus M_3$. The following example shows some basic ideas of the method.

Let’s assume for simplicity that the messages are written in capital letters with spaces but with no other punctuation. The letters are converted ...