THE GARDEN

Time-Seeded Encryption Key Weakness (Coarse Timestamp-Derived Keys)

Updated 19 Sep 2026

• •

  What it is

  • •

    If an encryption key is derived from the current time with coarse granularity (e.g. whole-second Unix timestamps, hashed to produce a key), then any two encryption operations that happen to occur within the same time window use the identical key — turning what looks like "fresh randomness every time" into a completely predictable, reusable key for anyone who can act fast enough. Combined with a pure XOR cipher (self-inverse: $(m\oplus k)\oplus k=m$), an attacker who can trigger two encryption calls back-to-back — one on the real secret, one on the resulting ciphertext — recovers the plaintext directly, the same underlying mechanism as OFB Mode Encryption-Decryption Symmetry and Two-Time Pad (XOR Key Reuse) , just triggered by timing rather than an explicit reused-nonce bug.

• •

  When to apply

  • •

    A key derivation function uses time.time() (or similar low-resolution timestamps) as its only entropy source, and you can make multiple requests to the same service quickly enough to land within the same time window.

• •

  Math

  • •

    $c_1=m\oplus k(t)$; if a second call happens within the same window, $k(t)$ is unchanged, so encrypting $c_1$ again gives $c_1\oplus k(t)=(m\oplus k(t))\oplus k(t)=m$.

• •

  Worked example

  • •

    If $k$ is unchanged for two calls, $E(m)=m\oplus k$ and $E(E(m))=(m\oplus k)\oplus k=m$. Submit the ciphertext bytes as the next plaintext within the same key window. This works for an XOR stream construction; it is not a general property of encryption.

• •

  Python

  • •

    ct = get_flag_ciphertext()
    recovered = encrypt_endpoint(ct)   # if called within the same key-derivation time window, this IS the plaintext
    

• •

  Related

  • •

    OFB Mode Encryption-Decryption Symmetry

  • •

    Two-Time Pad (XOR Key Reuse)

• •

  Cards

  • •

    Why does deriving a key from time.time() with second-level granularity create a vulnerability?

    • •

      Any two encryption calls within the same second reuse the identical key, breaking the "fresh key every time" assumption the scheme depends on.

  • •

    What property of the underlying cipher makes "encrypt the ciphertext again" recover the plaintext?

    • •

      A pure XOR cipher is self-inverse — XORing with the same key twice cancels out completely, exactly like OFB's encrypt/decrypt symmetry.

◌ Explore connections in Graph view