Updating a one time pad using one time pad encryption [duplicate]

Question

This is an absolute noob question - so please be gentle with me! I see that similar questions have been asked - but I think mine is different!

Apart from being wasteful on storage space, what is the weakness in the following simple encryption scheme? Assume truly random means from a natural source - such as cosmic microwave background...

Use an initial one time pad created from a truly random source which is at least twice the length of any conceivable message that could be sent. Compose messages with two equal sized parts: 1) The plain text message. 2) An update to the OTP composed of truly random data. Both parts encrypted against the original OTP. When a message is received the first half is decrypted against the OTP to reveal the plain text. Then the second half is decrypted to reveal the update OTP. Replace the initial OTP with the update OTP.

It seems to me that the strength of the OTP is preserved isn't it?

No part of the OPT gets used twice against plain text - it is immediately replaced by random data. The parts of the OTP that do get reused are used against random data. Assuming the update is truly random this couldn't be used to deduce the OTP and therefore also the update, could it?

Example encryption:

1. Bob and Alice both store initial key 9462367503982349.
2. Alice encrypts her message "FLEE!","66676" using part of key 9462367503 and sends it to Bob.
3. Alice changes the part of her pad used to encrypt "FLEE!" using "66676"
4. Bob receives and decrypts back to "FLEE!","66676".
5. Bob has received the message which is "FLEE!"
6. Bob changes the part of his pad used to encrypt "FLEE!" using "66676"
7. Both Alice's and Bob's pad is now 6667667503982349
8. Bob encrypts a reply "THANKYOU", "73613451" using part of pad 6667667503982349
9. Bob changes his pad so it reads 7361346103982349
10. Alice receives and decrypts back to "THANKYOU", "73613451"
11. Alice changes her pad so it reads 7361346103982349

In all cases a part of the pad is only used once to encrypt a plain text message and then it gets a replacement part. Parts of the pad are used multiple times to encrypt random data - but that doesn't matter because it doesn't reveal anything about the pad. If Eve intercepts a message the plain text part has been encrypted against a part of the pad that has only ever been used once. She would have to crack the encryption used on the random update part of the message to gain any information. The problem for Eve is that there are no clues because its a random pad encrypting random data. Every time Eve intercepts a message its been encrypted using a changed pad.

List item

Answer 1

Any re-use of the OTP is fatal. What you are proposing is effectively a "two-time pad" which for sure does not have the same security properties.

Attempting to model your cipher in a particular setting:

Given plaintexts P_i of k bits and an initial key K₀ of 2k bits:
K₀ = K_0a K_0b

The corresponding ciphertext is the concatenation of the encryption of the P_i and the "update OTP" K_1a:
C₀ = C_0a C_0b
C_0a = K_0a ⊕ P₀
C_0b = K_0b ⊕ K_1a

The key is updated to:
K₁ = K_1a K_0b

In the next round we have:
C₁ = C_1a C_1b
C_1a = K_1a ⊕ P₁
C_1b = K_0b ⊕ K_2a

Note the re-use of K_0b. The key is updated to:
K₂ = K_2a K_0b

In the next round we have:
C₂ = C_2a C_2b
C_2a = K_2a ⊕ P₂
C_2b = K_0b ⊕ K_3a

Now we can recover:

(C_0b ⊕ C_1b) ⊕ C_1a
= (K_0b ⊕ K_1a) ⊕ (K_0b ⊕ K_2a) ⊕ (K_1a ⊕ P₁)
= (K_1a ⊕ K_2a) ⊕ (K_1a ⊕ P₁)
= K_2a ⊕ P₁

Your cipher already fails a chosen-plaintext attack. As you can see above, one can recover the decryption key K_2a if you know P₁. This allows you to recover P₂.

This shows why your cipher is broken.