Hacker News Reader

Comment by klingonopera | Hacker News Reader

Thanks, yes, this shows how it is flawed for the XOR-variant of the OTP.

In 09:05 ([0]) you can see why, namely that K and K cancel each other out.

I don't think this would be the case with an additive cipher.

EDIT: Continuing the thought with an additive cipher:

  P1 + P2 = C1 + C2 + 2K
  2K = P1 + P2 - (C1 + C2)
  K = P1/2 + P2/2 - C1/2 - C2/2

Uhhh... we know both Cs. And... that's it?

[0]: https://youtu.be/yxx3Bkmv3ck?t=545

View on HN

It's not like it's hard to get K and K to cancel each other out using addition. Why are you generalizing from "the inverse of XORing K is XORing K again" to "the inverse of adding K is adding K again"? It isn't, but everyone knows what the inverse of adding K is.

    C1 = P1 + K
    C2 = P2 + K
    C1 - C2 = P1 - P2

And if you can guess part of either plaintext, you'll see the same part of the other plaintext, and know what the key was, exactly the same as for XORing. As somebody else already pointed out, that's because XORing is a variety of addition anyway.

Can't edit anymore, it should be

  P1 + P2 = C1 + C2 - 2K
  2K = C1 + C2 - (P1 + P2)

etc...

Reply on news.ycombinator.com