Two-Time Pad Attack
- •
Definition
- •
the catastrophic break that occurs whenever a one-time-pad or stream-cipher key is reused to encrypt more than one message
- •
- •
- •
Real-world examples
- •
Project VENONA — Soviet one-time pads in the 1940s were generated by hand (dice rolls) and, due to the labor involved, reused; US intelligence decrypted roughly 3,000 messages as a result
- •
Microsoft PPTP — encrypted the client->server stream and server->client stream with the same key, effectively creating a two-time pad between the two directions; fix: use a separate key per direction
- •
WEP (802.11b Wi-Fi) — prepended a 24-bit IV (incrementing counter) to a long-term key for each frame's stream-cipher key; the IV space is small enough (16.7M) that it cycles within a busy network (or resets to 0 on every power cycle), reusing the same effective key
- •
- •
The deeper WEP flaw: related-key weakness
- •
even setting aside IV reuse, WEP's per-frame keys (
IV || K) share a huge common suffix — they're not independent random keys, just the same key with a tiny varying prefix; the PRG used (RC4) isn't secure against such related-key inputs, letting the Fluhrer-Mantin-Shamir attack (2001) recover the full key from about a million frames — later refined to tens of thousands of frames - •
the fix: derive each frame's key by running the long-term key through a PRG and slicing off independent-looking segments, rather than lightly perturbing the same key
- •
- •
Lesson
- •
a stream cipher / one-time-pad key must never be reused — for network protocols, use one key per direction per session; for disk encryption specifically, don't use a stream cipher at all, since editing one file and re-saving it re-encrypts under the same key and reveals exactly where the file changed (a two-time pad on similar plaintexts) — see Malleability
- •
- •
Related