double encryption - One Time Pad
$begingroup$
Can the security of the encryption system be improved by using double encryption with two randomly chosen keys?
By double encryption I mean using two keys K1 and K2, each 20-bit long, to obtain ciphertext $C = ( M ⊕ K_1 ) ⊕ K_2$.
one-time-pad multiple-encryption
New contributor
$endgroup$
add a comment |
$begingroup$
Can the security of the encryption system be improved by using double encryption with two randomly chosen keys?
By double encryption I mean using two keys K1 and K2, each 20-bit long, to obtain ciphertext $C = ( M ⊕ K_1 ) ⊕ K_2$.
one-time-pad multiple-encryption
New contributor
$endgroup$
1
$begingroup$
An ideal one time pad already has perfect security, you can't just get twice as perfect. The second layer doesn't add much.
$endgroup$
– Natanael
5 hours ago
1
$begingroup$
I don't see how enumerating the key values makes any difference for the one-time pad. Even a single bit key for a single bit message would be secure.
$endgroup$
– Maarten Bodewes♦
3 hours ago
add a comment |
$begingroup$
Can the security of the encryption system be improved by using double encryption with two randomly chosen keys?
By double encryption I mean using two keys K1 and K2, each 20-bit long, to obtain ciphertext $C = ( M ⊕ K_1 ) ⊕ K_2$.
one-time-pad multiple-encryption
New contributor
$endgroup$
Can the security of the encryption system be improved by using double encryption with two randomly chosen keys?
By double encryption I mean using two keys K1 and K2, each 20-bit long, to obtain ciphertext $C = ( M ⊕ K_1 ) ⊕ K_2$.
one-time-pad multiple-encryption
one-time-pad multiple-encryption
New contributor
New contributor
edited 4 hours ago
Ella Rose♦
17k44483
17k44483
New contributor
asked 6 hours ago
MinaMina
61
61
New contributor
New contributor
1
$begingroup$
An ideal one time pad already has perfect security, you can't just get twice as perfect. The second layer doesn't add much.
$endgroup$
– Natanael
5 hours ago
1
$begingroup$
I don't see how enumerating the key values makes any difference for the one-time pad. Even a single bit key for a single bit message would be secure.
$endgroup$
– Maarten Bodewes♦
3 hours ago
add a comment |
1
$begingroup$
An ideal one time pad already has perfect security, you can't just get twice as perfect. The second layer doesn't add much.
$endgroup$
– Natanael
5 hours ago
1
$begingroup$
I don't see how enumerating the key values makes any difference for the one-time pad. Even a single bit key for a single bit message would be secure.
$endgroup$
– Maarten Bodewes♦
3 hours ago
1
1
$begingroup$
An ideal one time pad already has perfect security, you can't just get twice as perfect. The second layer doesn't add much.
$endgroup$
– Natanael
5 hours ago
$begingroup$
An ideal one time pad already has perfect security, you can't just get twice as perfect. The second layer doesn't add much.
$endgroup$
– Natanael
5 hours ago
1
1
$begingroup$
I don't see how enumerating the key values makes any difference for the one-time pad. Even a single bit key for a single bit message would be secure.
$endgroup$
– Maarten Bodewes♦
3 hours ago
$begingroup$
I don't see how enumerating the key values makes any difference for the one-time pad. Even a single bit key for a single bit message would be secure.
$endgroup$
– Maarten Bodewes♦
3 hours ago
add a comment |
3 Answers
3
active
oldest
votes
$begingroup$
The answer is we cannot improve the security of the one-time pad in this manner. Intuitively the reason is that the double one-time pad is just a less efficient one time pad.
The security of the traditional xor-based one-time pad is requires that the key $K$ is chosen uniformly at random for each message and that the key is at least as large as the message.
Because the xor operation is associative, we could re-write the double one-time pad as $C = M oplus(K_1 oplus K_2)$ or $ C = M oplus K$, where $K = K_1 oplus K_2$. Now if $K_1$ and $K_2$ are uniform, it is easy to show that $K$ is also uniform. Assuming the key and the message have length $n$
$P_K[k] = sum_{x in {0,1}^n}P_{K_1,K_2}[k_1 = x, k_2 = k oplus k_1] = frac{1}{2^n}$
In other words $K_1 oplus K_2$ could be simply replaced by a single uniform key, therefore $K_1$ is enough. Moreover the double one-time pad is inefficient because it requires two xor operations.
Regarding cascade encryption, Maurer and Massey showed that cascade encryption is as strong as the first cipher. Matthew Green's blog post is a nice (easy to read) summary of multi-encryption security.
$endgroup$
add a comment |
$begingroup$
For the one-time-pad the answer is no, since it already achieves information-theoretic security (meaning that the ciphertext is statistically independent from the plaintext).
So, applying it twice doesn’t add any extra security (and may actually worsen security if the second key is not independent from the first).
New contributor
$endgroup$
add a comment |
$begingroup$
The intention of a good cipher is to remove all orders and bit arrangements in a plaintext and produce output ciphertext in which there is no distinguishable orders and arrangements obtainable.I mean that the ciphertext should be a uniform distribution.
By considering this remark, if we have a good encrypted output(means plaintext which is encrypted with a good encryption algorithm ex AES),we can not find bit orders on it and re-encrypting the same output is ineffective and useless. In other words, imposing more security affections on the second encrypted ciphertext based on using the same cipher with another key is not remarkable, However we can not give a global rule for this.
An obvious example of this cipher types is 2DES (or even 3DES). This cipher, encrypts a plaintext with 2 different keys. Again the security of ciphertext rely on the DES structure. but we should consider that the whole system(2DES or 3DES) is vulnerable to meet-in-the-middle attack and in this situation and also the key space is not the sum of keys( k1+k2).
Therefore using ciphers in this manner is not more common. but if we want to encrypt a plaintext with two different ciphers with different keys, the whole structure gives more stamina to ciphertext against cryptanalysis.
And about One-time pad encryption, this cipher has a perfect security, so imposing another encryption with different key is waste of time and resources.
$endgroup$
$begingroup$
I'm not convinced that reencrypting the output of AES cannot strengthen the ciphertext in case weaknesses are found. For 2DES: even 2DES is more secure than single DES. It is not as strong as it should be given the doubling of the key size (which is actually also true for 3DES, only less so). So I'm finding myself disagreeing with a large portion of the answer (and agreeing with the last two sections).
$endgroup$
– Maarten Bodewes♦
4 hours ago
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
return StackExchange.using("mathjaxEditing", function () {
StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
});
});
}, "mathjax-editing");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "281"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Mina is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f68685%2fdouble-encryption-one-time-pad%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
$begingroup$
The answer is we cannot improve the security of the one-time pad in this manner. Intuitively the reason is that the double one-time pad is just a less efficient one time pad.
The security of the traditional xor-based one-time pad is requires that the key $K$ is chosen uniformly at random for each message and that the key is at least as large as the message.
Because the xor operation is associative, we could re-write the double one-time pad as $C = M oplus(K_1 oplus K_2)$ or $ C = M oplus K$, where $K = K_1 oplus K_2$. Now if $K_1$ and $K_2$ are uniform, it is easy to show that $K$ is also uniform. Assuming the key and the message have length $n$
$P_K[k] = sum_{x in {0,1}^n}P_{K_1,K_2}[k_1 = x, k_2 = k oplus k_1] = frac{1}{2^n}$
In other words $K_1 oplus K_2$ could be simply replaced by a single uniform key, therefore $K_1$ is enough. Moreover the double one-time pad is inefficient because it requires two xor operations.
Regarding cascade encryption, Maurer and Massey showed that cascade encryption is as strong as the first cipher. Matthew Green's blog post is a nice (easy to read) summary of multi-encryption security.
$endgroup$
add a comment |
$begingroup$
The answer is we cannot improve the security of the one-time pad in this manner. Intuitively the reason is that the double one-time pad is just a less efficient one time pad.
The security of the traditional xor-based one-time pad is requires that the key $K$ is chosen uniformly at random for each message and that the key is at least as large as the message.
Because the xor operation is associative, we could re-write the double one-time pad as $C = M oplus(K_1 oplus K_2)$ or $ C = M oplus K$, where $K = K_1 oplus K_2$. Now if $K_1$ and $K_2$ are uniform, it is easy to show that $K$ is also uniform. Assuming the key and the message have length $n$
$P_K[k] = sum_{x in {0,1}^n}P_{K_1,K_2}[k_1 = x, k_2 = k oplus k_1] = frac{1}{2^n}$
In other words $K_1 oplus K_2$ could be simply replaced by a single uniform key, therefore $K_1$ is enough. Moreover the double one-time pad is inefficient because it requires two xor operations.
Regarding cascade encryption, Maurer and Massey showed that cascade encryption is as strong as the first cipher. Matthew Green's blog post is a nice (easy to read) summary of multi-encryption security.
$endgroup$
add a comment |
$begingroup$
The answer is we cannot improve the security of the one-time pad in this manner. Intuitively the reason is that the double one-time pad is just a less efficient one time pad.
The security of the traditional xor-based one-time pad is requires that the key $K$ is chosen uniformly at random for each message and that the key is at least as large as the message.
Because the xor operation is associative, we could re-write the double one-time pad as $C = M oplus(K_1 oplus K_2)$ or $ C = M oplus K$, where $K = K_1 oplus K_2$. Now if $K_1$ and $K_2$ are uniform, it is easy to show that $K$ is also uniform. Assuming the key and the message have length $n$
$P_K[k] = sum_{x in {0,1}^n}P_{K_1,K_2}[k_1 = x, k_2 = k oplus k_1] = frac{1}{2^n}$
In other words $K_1 oplus K_2$ could be simply replaced by a single uniform key, therefore $K_1$ is enough. Moreover the double one-time pad is inefficient because it requires two xor operations.
Regarding cascade encryption, Maurer and Massey showed that cascade encryption is as strong as the first cipher. Matthew Green's blog post is a nice (easy to read) summary of multi-encryption security.
$endgroup$
The answer is we cannot improve the security of the one-time pad in this manner. Intuitively the reason is that the double one-time pad is just a less efficient one time pad.
The security of the traditional xor-based one-time pad is requires that the key $K$ is chosen uniformly at random for each message and that the key is at least as large as the message.
Because the xor operation is associative, we could re-write the double one-time pad as $C = M oplus(K_1 oplus K_2)$ or $ C = M oplus K$, where $K = K_1 oplus K_2$. Now if $K_1$ and $K_2$ are uniform, it is easy to show that $K$ is also uniform. Assuming the key and the message have length $n$
$P_K[k] = sum_{x in {0,1}^n}P_{K_1,K_2}[k_1 = x, k_2 = k oplus k_1] = frac{1}{2^n}$
In other words $K_1 oplus K_2$ could be simply replaced by a single uniform key, therefore $K_1$ is enough. Moreover the double one-time pad is inefficient because it requires two xor operations.
Regarding cascade encryption, Maurer and Massey showed that cascade encryption is as strong as the first cipher. Matthew Green's blog post is a nice (easy to read) summary of multi-encryption security.
edited 4 hours ago
answered 4 hours ago
Marc IlungaMarc Ilunga
37817
37817
add a comment |
add a comment |
$begingroup$
For the one-time-pad the answer is no, since it already achieves information-theoretic security (meaning that the ciphertext is statistically independent from the plaintext).
So, applying it twice doesn’t add any extra security (and may actually worsen security if the second key is not independent from the first).
New contributor
$endgroup$
add a comment |
$begingroup$
For the one-time-pad the answer is no, since it already achieves information-theoretic security (meaning that the ciphertext is statistically independent from the plaintext).
So, applying it twice doesn’t add any extra security (and may actually worsen security if the second key is not independent from the first).
New contributor
$endgroup$
add a comment |
$begingroup$
For the one-time-pad the answer is no, since it already achieves information-theoretic security (meaning that the ciphertext is statistically independent from the plaintext).
So, applying it twice doesn’t add any extra security (and may actually worsen security if the second key is not independent from the first).
New contributor
$endgroup$
For the one-time-pad the answer is no, since it already achieves information-theoretic security (meaning that the ciphertext is statistically independent from the plaintext).
So, applying it twice doesn’t add any extra security (and may actually worsen security if the second key is not independent from the first).
New contributor
New contributor
answered 4 hours ago
guilhermemtrguilhermemtr
1214
1214
New contributor
New contributor
add a comment |
add a comment |
$begingroup$
The intention of a good cipher is to remove all orders and bit arrangements in a plaintext and produce output ciphertext in which there is no distinguishable orders and arrangements obtainable.I mean that the ciphertext should be a uniform distribution.
By considering this remark, if we have a good encrypted output(means plaintext which is encrypted with a good encryption algorithm ex AES),we can not find bit orders on it and re-encrypting the same output is ineffective and useless. In other words, imposing more security affections on the second encrypted ciphertext based on using the same cipher with another key is not remarkable, However we can not give a global rule for this.
An obvious example of this cipher types is 2DES (or even 3DES). This cipher, encrypts a plaintext with 2 different keys. Again the security of ciphertext rely on the DES structure. but we should consider that the whole system(2DES or 3DES) is vulnerable to meet-in-the-middle attack and in this situation and also the key space is not the sum of keys( k1+k2).
Therefore using ciphers in this manner is not more common. but if we want to encrypt a plaintext with two different ciphers with different keys, the whole structure gives more stamina to ciphertext against cryptanalysis.
And about One-time pad encryption, this cipher has a perfect security, so imposing another encryption with different key is waste of time and resources.
$endgroup$
$begingroup$
I'm not convinced that reencrypting the output of AES cannot strengthen the ciphertext in case weaknesses are found. For 2DES: even 2DES is more secure than single DES. It is not as strong as it should be given the doubling of the key size (which is actually also true for 3DES, only less so). So I'm finding myself disagreeing with a large portion of the answer (and agreeing with the last two sections).
$endgroup$
– Maarten Bodewes♦
4 hours ago
add a comment |
$begingroup$
The intention of a good cipher is to remove all orders and bit arrangements in a plaintext and produce output ciphertext in which there is no distinguishable orders and arrangements obtainable.I mean that the ciphertext should be a uniform distribution.
By considering this remark, if we have a good encrypted output(means plaintext which is encrypted with a good encryption algorithm ex AES),we can not find bit orders on it and re-encrypting the same output is ineffective and useless. In other words, imposing more security affections on the second encrypted ciphertext based on using the same cipher with another key is not remarkable, However we can not give a global rule for this.
An obvious example of this cipher types is 2DES (or even 3DES). This cipher, encrypts a plaintext with 2 different keys. Again the security of ciphertext rely on the DES structure. but we should consider that the whole system(2DES or 3DES) is vulnerable to meet-in-the-middle attack and in this situation and also the key space is not the sum of keys( k1+k2).
Therefore using ciphers in this manner is not more common. but if we want to encrypt a plaintext with two different ciphers with different keys, the whole structure gives more stamina to ciphertext against cryptanalysis.
And about One-time pad encryption, this cipher has a perfect security, so imposing another encryption with different key is waste of time and resources.
$endgroup$
$begingroup$
I'm not convinced that reencrypting the output of AES cannot strengthen the ciphertext in case weaknesses are found. For 2DES: even 2DES is more secure than single DES. It is not as strong as it should be given the doubling of the key size (which is actually also true for 3DES, only less so). So I'm finding myself disagreeing with a large portion of the answer (and agreeing with the last two sections).
$endgroup$
– Maarten Bodewes♦
4 hours ago
add a comment |
$begingroup$
The intention of a good cipher is to remove all orders and bit arrangements in a plaintext and produce output ciphertext in which there is no distinguishable orders and arrangements obtainable.I mean that the ciphertext should be a uniform distribution.
By considering this remark, if we have a good encrypted output(means plaintext which is encrypted with a good encryption algorithm ex AES),we can not find bit orders on it and re-encrypting the same output is ineffective and useless. In other words, imposing more security affections on the second encrypted ciphertext based on using the same cipher with another key is not remarkable, However we can not give a global rule for this.
An obvious example of this cipher types is 2DES (or even 3DES). This cipher, encrypts a plaintext with 2 different keys. Again the security of ciphertext rely on the DES structure. but we should consider that the whole system(2DES or 3DES) is vulnerable to meet-in-the-middle attack and in this situation and also the key space is not the sum of keys( k1+k2).
Therefore using ciphers in this manner is not more common. but if we want to encrypt a plaintext with two different ciphers with different keys, the whole structure gives more stamina to ciphertext against cryptanalysis.
And about One-time pad encryption, this cipher has a perfect security, so imposing another encryption with different key is waste of time and resources.
$endgroup$
The intention of a good cipher is to remove all orders and bit arrangements in a plaintext and produce output ciphertext in which there is no distinguishable orders and arrangements obtainable.I mean that the ciphertext should be a uniform distribution.
By considering this remark, if we have a good encrypted output(means plaintext which is encrypted with a good encryption algorithm ex AES),we can not find bit orders on it and re-encrypting the same output is ineffective and useless. In other words, imposing more security affections on the second encrypted ciphertext based on using the same cipher with another key is not remarkable, However we can not give a global rule for this.
An obvious example of this cipher types is 2DES (or even 3DES). This cipher, encrypts a plaintext with 2 different keys. Again the security of ciphertext rely on the DES structure. but we should consider that the whole system(2DES or 3DES) is vulnerable to meet-in-the-middle attack and in this situation and also the key space is not the sum of keys( k1+k2).
Therefore using ciphers in this manner is not more common. but if we want to encrypt a plaintext with two different ciphers with different keys, the whole structure gives more stamina to ciphertext against cryptanalysis.
And about One-time pad encryption, this cipher has a perfect security, so imposing another encryption with different key is waste of time and resources.
edited 5 hours ago
answered 5 hours ago
Arsalan VahiArsalan Vahi
1169
1169
$begingroup$
I'm not convinced that reencrypting the output of AES cannot strengthen the ciphertext in case weaknesses are found. For 2DES: even 2DES is more secure than single DES. It is not as strong as it should be given the doubling of the key size (which is actually also true for 3DES, only less so). So I'm finding myself disagreeing with a large portion of the answer (and agreeing with the last two sections).
$endgroup$
– Maarten Bodewes♦
4 hours ago
add a comment |
$begingroup$
I'm not convinced that reencrypting the output of AES cannot strengthen the ciphertext in case weaknesses are found. For 2DES: even 2DES is more secure than single DES. It is not as strong as it should be given the doubling of the key size (which is actually also true for 3DES, only less so). So I'm finding myself disagreeing with a large portion of the answer (and agreeing with the last two sections).
$endgroup$
– Maarten Bodewes♦
4 hours ago
$begingroup$
I'm not convinced that reencrypting the output of AES cannot strengthen the ciphertext in case weaknesses are found. For 2DES: even 2DES is more secure than single DES. It is not as strong as it should be given the doubling of the key size (which is actually also true for 3DES, only less so). So I'm finding myself disagreeing with a large portion of the answer (and agreeing with the last two sections).
$endgroup$
– Maarten Bodewes♦
4 hours ago
$begingroup$
I'm not convinced that reencrypting the output of AES cannot strengthen the ciphertext in case weaknesses are found. For 2DES: even 2DES is more secure than single DES. It is not as strong as it should be given the doubling of the key size (which is actually also true for 3DES, only less so). So I'm finding myself disagreeing with a large portion of the answer (and agreeing with the last two sections).
$endgroup$
– Maarten Bodewes♦
4 hours ago
add a comment |
Mina is a new contributor. Be nice, and check out our Code of Conduct.
Mina is a new contributor. Be nice, and check out our Code of Conduct.
Mina is a new contributor. Be nice, and check out our Code of Conduct.
Mina is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Cryptography Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
Use MathJax to format equations. MathJax reference.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f68685%2fdouble-encryption-one-time-pad%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
$begingroup$
An ideal one time pad already has perfect security, you can't just get twice as perfect. The second layer doesn't add much.
$endgroup$
– Natanael
5 hours ago
1
$begingroup$
I don't see how enumerating the key values makes any difference for the one-time pad. Even a single bit key for a single bit message would be secure.
$endgroup$
– Maarten Bodewes♦
3 hours ago