4

Given a set of plain texts $P \subseteq \{0, 1\}^n$. Assume we know the corresponding set of cipher texts $C \subseteq \{0, 1\}^n$ produced by applying one-time pad with an unknown key $k \in \{0, 1\}^n$.

Question: How to compute $k$, based on $P$ and $C$?

My approach: For every pair $(p, c) \in P \times C$, compute the key $k' = p \oplus c$. Output the key most frequent key $k'$.

My question: What is the probability of success of the proposed algorithm?

The problem with this approach is that the most frequent key $k'$ is unique in some cases. In some other cases, $k'$ is not unique. For example, when $P = C = \{0, 1\}^n$.

curiouscupcake
  • 141
  • 2

3 Answers3

0

Nitpick: As soon as $|P|>1$ (several plaintexts), it's not applied the One Time Pad, but "XOR with a key". I'll assume that.

For many instances of the problem, it can be ruled some keys $k=p\oplus c$ by finding a plaintext $p'$ such $p'\oplus k$ is not in $C$. The question's method does not do this, and considers keys that could be eliminated.

For relatively small $P$ and $C$ (or same size), this algorithm will work nicely:

  • make a set of already tested keys, initially empty.
  • for each pair $(p,c)\in P\times C$
    • $k\gets p\oplus c$
    • if $k$ is not in the set
      • enter $k$ in the set
      • for each $p'$ in $P$
        • if $p'\oplus k$ is not in $C$
          • exit the loop and skip next step, moving to the next pair $(p,c)$
      • print $k$ which is a possible key.

When $|P|=2$, the algorithm let to terminate always outputs 2 keys, and if we stop at the first it's success rate is $1/2$.

For larger $|P|$ forming a small haphazard subset of possible plaintexts, chances are good that there's a single key, and success rate is near $1$. On the other hand it's easy to make pathological $P$ with $|P|=2^n$ allowing $2^n$ keys.

This does not answer the part of the question asking the success rate of the initial algorithm.

fgrieu
  • 140,762
  • 12
  • 307
  • 587
0

Let $m$ be the number of plaintexts/ciphertexts.

Notice that we will get multiple solutions if and only if $\{p:p\in P\}=\{p\oplus \Delta k:p\in P\}$ for some non-zero $\Delta k$.

We begin with the case when $m$ is odd. In this case the probability of success is 1, for if such a $\Delta k$ existed, we could pair up the plaintexts exactly.

For the case where $m\equiv 2\pmod 4$, we can count the bad cases as follows. There are $2^n-1$ choices of $\Delta k$ and for a given $\Delta k$ there are $2^{n-1}$ possible cosets $\{p,p\oplus\Delta k\}$ of which we are at liberty to pick any $m/2$. Thus the probability of success is $$1-\frac{(2^n-1)\binom{2^{n-1}}{m/2}}{\binom{2^n}m}.$$

In the case where $m\equiv 4\pmod 8$ the same analysis applies except that we have overcounted in the case where there is more than one $\Delta k$. We note that the set of possible $\Delta k$ including zero is subspace of $\{0,1\}^n$ and that there are $(2^n-1)!/6(2^{n-2}-1)!$ ways of choosing a subspace of size 4 (subspaces of size larger than 4 are not possible as $|P|$ must be divisible by the subspace size). For such instances, our previous arguments counts 3 times instead of once. Thus in this case the probability of success is given by $$1-\frac{(2^n-1)\binom{2^{n-1}}{m/2}}{\binom{2^n}m}+2\frac{(2^n-1)!\binom{2^{n-2}}{m/4}}{6(2^{n-2}-1)!\binom{2^n}m}.$$

The argument can be iterated with respect to the largest power of 2 dividing $m$ provided that we know an expression for the number of subspaces of $\mathbb F_2^s$ of dimension $t$ (see this post for example).

Daniel S
  • 23,716
  • 1
  • 29
  • 67
0

Given we have the sets $P$ and $C$, to find $k$, we need only find (one of) the pairs $(p,c)\in P \times C$ s.t. $p \oplus k = c$, as with this pair, $k$ is trivial to compute.

First, we can note the property that given two corresponding pairs $(p_1, c_1)$ and $(p_2, c_2) \in P \times C$, $c_1 \oplus c_2 = p_1 \oplus p_2$ - in other words, the difference between two ciphertexts is the same as the difference between their corresponding ciphertexts.

We can use this to which of our plaintexts correspond to the ciphertexts, as assuming $c_i \ne c_j$, the set of differences, $d_i^c$, for a given $c_i$ with all other words in $C$ will be unique. The same holds for a given $p_i$, with $d_i^p \ne d_j^p$ for any other set of differences for a different plaintext in $P$, however for corresponding plaintext ciphertext pairs, these differences will be the same.

For example, if $p_1$ encrypts to $c_1$, then $d_1^p = d_1^c$, and we are able to pair these two as we know these differences are unique to the given plaintext/ciphertext.

This then allows us to calculate $k = p_1 \oplus c_1$.

supinie
  • 46
  • 4