L19 · One-Time Pad, XOR & the IND-CPA Game

Discussion prompt

Before we open L19 · One-Time Pad, XOR & the IND-CPA Game: without looking back, what was the main idea of L18 · Kerckhoff's Principle, Attacker Models & IND-CPA, and what could you do by the end of it that you could not do before?

Hint: One sentence for the idea, one for the skill. If the second one is blank, that is the part to revisit.

Match the pairs

From Three questions this lesson answers — match each one to what it actually does. The descriptions have been shuffled.

• c1. What is the tool?
• c2. What is the cipher?
• c3. Does it pass IND-CPA?

• b1. §6.2 XOR — one operation, four algebra laws
• b2. §6.3 the one-time pad and its perfect secrecy
• b3. §6.1 yes once, NO if the key is reused

Why: What is the tool?, What is the cipher?, Does it pass IND-CPA? are easy to tell apart while they are sitting next to their descriptions and much harder afterwards, which is what this checks.

Comparison matrix

From §6.2 XOR, by its truth table: refill the y column from what you know. The rest of the table is as it appeared.

Discussion prompt

XOR obeys four laws. Each one is just the truth table, written as an identity you can apply mechanically.

That is stated as though it always holds. Do one of two things: produce a case where it fails, or say precisely what rules such a case out. "It just does" is not on the menu.

Hint: Hunt at the extremes first — zero, one, negative, empty, equal. If every extreme survives, the reason they survive is the proof.

Discussion prompt

Explain §6.2 Why XOR is its own undo button by analogy to something with no Computer Security in it at all — a queue, a recipe, a map, a bank balance, whatever fits. Then say where your analogy breaks.

Hint: An analogy that never breaks is not an analogy, it is the same idea wearing a hat. Find the seam — that is the part that is actually new.

Put in order

Put the moves of §6.2 Confirm two algebra laws on the truth table into the order they have to happen.

1. Check identity x ⊕ 0 = x for both values of x
2. Check self-inverse x ⊕ x = 0 for both values of x
3. Verify: both laws hold on every row, so they hold for all bits

Why: These are the moves of the worked example in the order it makes them, and each one is set up by the one before it. Read rows of the truth table where the second input is 0: the output equals the first input.

Comparison matrix

From §6.2 Confirm two algebra laws on the truth table: every row here is a choice with a cost. Fill the 0 column, then say which row you would actually pick and what you give up for it.

Discussion prompt

Explain §6.2 The handy identity: cancel out the x to a student a year behind you. No notation, no jargon they have not met — and it still has to be true.

Hint: If your explanation needs a symbol they have never seen, you are describing the notation rather than the idea.

Discussion prompt

§6.2 XOR algebra: solve a bit equation — before any calculation: what is the plan? Name the moves in order, in plain English, without doing the arithmetic.

Hint: It starts with: Start from the equation to solve for y

Annotate

From §6.2 XOR algebra: solve a bit equation — read this one piece at a time. What is each part doing?

On: \( y \oplus 1 \oplus 1 = 0 \oplus 1 \)

• We are given a relationship between an unknown bit y and a known bit, and want y by itself.
• Just like adding the same number to both sides of an equation — XOR-ing both sides by the same value keeps them equal.
• Self-inverse: 1 ⊕ 1 = 0, and identity: y ⊕ 0 = y. On the right, 0 ⊕ 1 = 1.

Predict first

A student writes this, and it looks reasonable:

A student: 'XOR is basically OR, so 1 ⊕ 1 = 1, and a value XOR-ed with itself stays itself.'

It is wrong. Say what breaks — and say it before you turn the page.

Correct: OR gives 1 ⊕ 1 = 1, but XOR outputs 1 only when bits DIFFER — equal bits give 0.

A student: apply the XOR truth table exactly.

Why: OR gives 1 ⊕ 1 = 1, but XOR outputs 1 only when bits DIFFER — equal bits give 0. Forgetting x ⊕ x = 0 destroys every OTP proof.

Discussion prompt

The rule this trap just fixed:

A student: apply the XOR truth table exactly.

Now break it on purpose. Build a case that violates it and follow the consequences until something visibly fails. Where does the failure first show up — and would you have noticed it if you had not been looking?

Hint: The dangerous rules are the ones whose violation still produces an answer. If yours fails loudly, try to find one that fails quietly.

Sort into buckets

Every line below is part of the definition of XOR (⊕) or of One-time pad (OTP) — one or the other, never both. Put each where it belongs.

XOR (⊕)

The exclusive-or of two bits; 1 when the bits differ, 0 when they are the same.; Equivalently, addition modulo 2.

One-time pad (OTP)

Alice and Bob share an n-bit key K = k_1…k_n chosen uniformly at random (n independent fair coin flips).; Encryption and decryption are a single XOR with that key.

b1

The exclusive-or of two bits: 1 when the bits differ, 0 when they are the same. Equivalently, addition modulo 2.

b2

Alice and Bob share an n-bit key K = k_1…k_n chosen uniformly at random (n independent fair coin flips). Encryption and decryption are a single XOR with that key.

Fill in the blanks

From §6.3 Derive decryption from encryption — finish the line. Write what belongs on the right of the equals sign before you look.

c_j = m_j \oplus k_j

Why: Producing the right-hand side unprompted is the difference between recognising this line and being able to use it. Encryption is defined bit-by-bit: the j-th ciphertext bit is the j-th message bit XOR the j-th key bit.

Draw it

Draw what §6.3 Derive decryption from encryption just did — the shape of it, not the line-by-line working. One picture, labels only where you need them. Then check it against the steps: anything you could not draw is a step you followed rather than understood.

Predict first

The table runs: 1 | 1 | 0 | 1 · 2 | 0 | 1 | 1 · 3 | 1 | 1 | 0

In §6.3 Encrypt and decrypt a 4-bit message, given the rows so far: what is the next one — the row where bit j is 4?

Correct: 4 | 1 | 0 | 1

Why: The relationship between the columns, not the individual numbers, is what generates the next row. A concrete 4-bit message and a 4-bit pad; the pad was generated by fair coin flips and shared in advance.

Comparison matrix

From §6.3 Encrypt and decrypt a 4-bit message: refill the m_j column from what you know. The rest of the table is as it appeared.

Predict first

A student writes this, and it looks reasonable:

A student: 'I'll save key bits — use a memorable phrase or a repeating pattern as the pad. It's still XOR, so it's still a one-time pad.'

It is wrong. Say what breaks — and say it before you turn the page.

Correct: A predictable pad is guessable: Eve who suspects k_j leans on it, and any repetition reintroduces the reuse leak.

A student: what makes a pad a real one-time pad?

Why: A predictable pad is guessable: Eve who suspects k_j leans on it, and any repetition reintroduces the reuse leak. Structure destroys perfect secrecy.

Match the pairs

Match each term to the definition this lesson gave it — not the one you would guess from the word.

• t1. XOR (⊕)
• t2. One-time pad (OTP)
• t3. Perfect (information-theoretic) secrecy

• d1. The exclusive-or of two bits: 1 when the bits differ, 0 when they are the same. Equivalently, addition modulo 2.
• d2. Alice and Bob share an n-bit key K = k_1…k_n chosen uniformly at random (n independent fair coin flips). Encryption and decryption are a single XOR with that key.
• d3. The ciphertext is statistically independent of the plaintext: seeing C tells Eve nothing about M she didn't already know. No amount of computation can change that.

Why: These are the working definitions of XOR (⊕), One-time pad (OTP), Perfect (information-theoretic) secrecy as L19 · One-Time Pad, XOR & the IND-CPA Game uses them. Pairing them correctly is the test of whether you could state each one with the slide switched off.

Discussion prompt

§6.3 Every ciphertext is achievable by one key — before any calculation: what is the plan? Name the moves in order, in plain English, without doing the arithmetic.

Hint: It starts with: Fix the plaintext M and pick ANY target ciphertext C

Draw it

Translate both ways. First write the expression above as a sentence with no symbols in it at all. Then cover it, and write your sentence back as notation. If the two versions disagree, the disagreement is the thing to fix.

Predict first

§6.3 Same ciphertext, two different plaintexts is about to be worked. State your hypothesis first: which rule or definition decides this one, and what is the first move it forces? Then watch whether the example agrees with you.

Correct: Suppose Eve sees the ciphertext C = 1101 and wonders if the message was 1011

Why: We test whether seeing C lets Eve rule any plaintext in or out — if not, C carries no information about M.

A hypothesis you wrote down is falsifiable; a vague sense of how it will go is not. If the example opens somewhere else, that gap is the thing worth chasing.

Comparison matrix

From §6.3 Same ciphertext, two different plaintexts: every row here is a choice with a cost. Fill the key K = M ⊕ C column, then say which row you would actually pick and what you give up for it.

Put in order

Put the moves of §6.3 The key cancels: C ⊕ C′ = M ⊕ M′ into the order they have to happen.

1. Suppose the SAME key K encrypts two messages M and M′
2. Eve XORs the two ciphertexts together
3. Reorder and cancel the two copies of K
4. Verify the leak: Eve now holds M ⊕ M′ with no key needed

Why: These are the moves of the worked example in the order it makes them, and each one is set up by the one before it. C = M ⊕ K and C′ = M′ ⊕ K — Eve intercepts both ciphertexts off the wire.

Discussion prompt

§6.3 Compute C ⊕ C′ from two intercepted ciphertexts — before any calculation: what is the plan? Name the moves in order, in plain English, without doing the arithmetic.

Hint: It starts with: Eve intercepts two ciphertexts made with the same pad: C = 1101 and…

Comparison matrix

From §6.3 Compute C ⊕ C′ from two intercepted ciphertexts: refill the c_j column from what you know. The rest of the table is as it appeared.

Predict first

A student writes this, and it looks reasonable:

A student: 'I can safely reuse a one-time pad as long as I encrypt two DIFFERENT messages with it.'

It is wrong. Say what breaks — and say it before you turn the page.

Correct: Backwards. Different plaintexts are exactly the break: C ⊕ C′ = M ⊕ M′ leaks information about how the two messages relate — and with one known, the other falls.

A student: when is a pad safe to use a second time?

Why: Backwards. Different plaintexts are exactly the break: C ⊕ C′ = M ⊕ M′ leaks information about how the two messages relate — and with one known, the other falls.

Discussion prompt

Explain §6.1 Advantage: how far above a coin flip to a student a year behind you. No notation, no jargon they have not met — and it still has to be true.

Hint: If your explanation needs a symbol they have never seen, you are describing the notation rather than the idea.

Discussion prompt

Explain §6.1 Single-use OTP would WIN this game by analogy to something with no Computer Security in it at all — a queue, a recipe, a map, a bank balance, whatever fits. Then say where your analogy breaks.

Hint: An analogy that never breaks is not an analogy, it is the same idea wearing a hat. Find the seam — that is the part that is actually new.

Discussion prompt

§6.1 Prove OTP-with-key-reuse is NOT IND-CPA — before any calculation: what is the plan? Name the moves in order, in plain English, without doing the arithmetic.

Hint: It starts with: Setup: the scheme uses a FIXED key K for both the oracle and the…

Annotate

From §6.1 Prove OTP-with-key-reuse is NOT IND-CPA — read this one piece at a time. What is each part doing?

On: \( b' = \begin{cases} 0 & \text{if } C = M_0 \oplus K \\ 1 & \text{otherwise} \end{cases} \)

• This is the broken variant — the same pad K encrypts every message, including Eve's chosen queries. (A correct OTP would never do this.)
• Standard first move of the game; b is hidden, and Eve wants to decide whether C hides M_0 or M_1.
• CPA power lets Eve get the exact ciphertext M_0 produces under the SAME key K — that reuse is the fatal opening.

Put in order

Put the moves of §6.1 The break, with concrete bits into the order they have to happen.

1. Eve submits M_0 = 1011 and M_1 = 0000 to the reused-key challenger
2. The challenger flips b and returns C = M_b ⊕ K
3. Eve queries the oracle on M_0 = 1011 and gets back M_0 ⊕ K = 1101
4. Eve outputs b′ = 0 if C = 1101, else b′ = 1
5. Verify Eve is always right: advantage |1 − 1/2| = 1/2

Why: These are the moves of the worked example in the order it makes them, and each one is set up by the one before it. Two distinct equal-length messages; the challenger holds a fixed K, say 0110, hidden from Eve.

Draw it

Draw what §6.1 The break, with concrete bits just did — the shape of it, not the line-by-line working. One picture, labels only where you need them. Then check it against the steps: anything you could not draw is a step you followed rather than understood.

Predict first

A student writes this, and it looks reasonable:

A student: 'VENONA and the reuse attack prove the one-time pad is insecure — don't use it.'

It is wrong. Say what breaks — and say it before you turn the page.

Correct: Wrong target. Used correctly — random key, used ONCE — the OTP has perfect secrecy and cannot be broken by any amount of computation.

A student: what exactly failed in the two-time-pad attacks?

Why: Wrong target. Used correctly — random key, used ONCE — the OTP has perfect secrecy and cannot be broken by any amount of computation. It was REUSE that broke.

Sort into buckets

Some of these hold up and some are the exact mistakes this lesson is built to prevent. Sort them.

Holds up

Last lesson set the rules of the game — Kerckhoff, the attacker models, and IND-CPA. Now we build the very first cipher and hold it to that bar.; Read it as: 'output 1 exactly when the inputs disagree.' That single fact generates everything else.; XOR obeys four laws. Each one is just the truth table, written as an identity you can apply mechanically.

Breaks

A student: 'XOR is basically OR, so 1 ⊕ 1 = 1, and a value XOR-ed with itself stays itself.'; A student: 'I'll save key bits — use a memorable phrase or a repeating pattern as the pad. It's still XOR, so it's still a one-time pad.'

sound

These are stated as this lesson states them — each one survives the edge cases L19 · One-Time Pad, XOR & the IND-CPA Game puts it through.

flawed

Each of these is lifted from a trap in this deck: reasonable-sounding, and wrong in a way that only shows up once you rely on it.

Discussion prompt

The break feels almost too easy — but notice what the chosen-plaintext oracle actually is: a second encryption under the SAME key K. That is precisely the situation OTP forbids.

That is stated as though it always holds. Do one of two things: produce a case where it fails, or say precisely what rules such a case out. "It just does" is not on the menu.

Hint: Hunt at the extremes first — zero, one, negative, empty, equal. If every extreme survives, the reason they survive is the proof.

Discussion prompt

Run The one-time-pad playbook with this step confiscated:

Never reuse: two messages under one key give C⊕C′ = M⊕M′; known M ⇒ M′ = (M⊕M′)⊕M and K = M⊕C (VENONA).

Is it still possible? If it is, say what takes its place and what it costs you. If it is not, say exactly what that step was providing that nothing else does.

Hint: A step you can drop for free was never load-bearing. If you cannot drop it, name the thing that goes wrong the moment it is gone.

Discussion prompt

The one-time-pad playbook works on the cases you have just seen. Push it to the edge: what is the most degenerate input it still handles — empty, zero, one item, everything equal — and what is the first case where it stops being true? Name the case, not just "it breaks".

Hint: Try the smallest legal input, then the largest, then the one where two things collide. Methods are specified at their edges; the middle takes care of itself.

Eliminate the wrong options

From C and C′ alone (same key K reused), what can Eve compute with certainty?

3 of these 4 are wrong. Strike them one at a time, and say what rules each one out before you strike the next. The survivor is the answer.

• A. M ⊕ M′, the XOR of the two plaintexts — the key cancels out.
• B. Nothing at all; reusing the key still gives perfect secrecy for each message.
• C. Both M and M′ directly, in full, with no further information.
• D. The key K, but not M ⊕ M′.

Survives elimination: A

Why: §6.3: C = M ⊕ K and C′ = M′ ⊕ K, so C ⊕ C′ = (M ⊕ K) ⊕ (M′ ⊕ K) = M ⊕ M′ because K ⊕ K = 0. Eve gets the XOR of the two plaintexts with no key. She cannot separate M from M′ without extra information (e.g. a known message or crib), but the reuse has already broken perfect secrecy.

Check your understanding

From C and C′ alone (same key K reused), what can Eve compute with certainty?

• A. M ⊕ M′, the XOR of the two plaintexts — the key cancels out. (correct)
• B. Nothing at all; reusing the key still gives perfect secrecy for each message.
• C. Both M and M′ directly, in full, with no further information.
• D. The key K, but not M ⊕ M′.

Answer: A

Why: §6.3: C = M ⊕ K and C′ = M′ ⊕ K, so C ⊕ C′ = (M ⊕ K) ⊕ (M′ ⊕ K) = M ⊕ M′ because K ⊕ K = 0. Eve gets the XOR of the two plaintexts with no key. She cannot separate M from M′ without extra information (e.g. a known message or crib), but the reuse has already broken perfect secrecy.

Why B tempts people

Perfect secrecy holds only for a SINGLE use of the key. The moment one key covers two messages, XOR-ing the ciphertexts cancels K and leaks M ⊕ M′ — the guarantee is gone.

Why C tempts people

Eve gets only the combined M ⊕ M′, not the individual plaintexts. Recovering M and M′ separately requires additional info such as a known message or predictable structure (crib-dragging).

Why D tempts people

The key does not drop out by itself: C ⊕ C′ cancels K and yields M ⊕ M′. Eve can only recover K if she additionally learns one plaintext (then K = M ⊕ C) — not from C and C′ alone.

Draw it

One page, no notation unless you need it: draw how these connect — One Operation: XOR · The One-Time Pad · Why It's Perfectly Secret · The Fatal Flaw: Key Reuse · Holding OTP to the IND-CPA Bar. Put an arrow wherever one of them is what makes another possible, and label the arrow with why.