I read that because the Soviets weren't careful enough with their one-time-pads, by unintentionally reusing some, they allowed the West to break their encrypted communication.

Does this mean that when using such a technique you would essentially have to have a list of all previously used ones to ensure you don't reuse any? Even if you had a method of true randomness when creating them wouldn't there be the possibility of generating the same one again?

I can imagine having a store of all previously used ones would pose quite a risk too.

4 Answers 4


A one time pad is just a random secret key which is used to encrypt some text in the same size of the key. There is no need to remember which one time pad got used if you just destroy it after use. There is no need to keep it since you've already used it once for encryption.


If you use a new random one-time pad for each message, you don't need to keep track of the ones you used.

The chance that you accidentally create an identical one as used before is practically zero. That is, it would be just as likely as accidentally creating a one-time pad that doesn't alter you message at all - or one that changes your message to one of the same length but with the opposite meaning.

In fact, any constraints you impose on randomly generated OTPs makes them less effective because they're not random anymore and an attacker could potentially take advantage of that.


Does this mean that when using such a technique you would essentially have to have a list of all previously used ones to ensure you don't reuse any?

This must be seen in the original context in which two parties would share a code book made up of one lengthy random sequence.

Normally you use a given sequence - you need to send a 1000 character message, you use the first unused OTP characters in the code book, and then destroy them. You note the position in the OTP key, and send it along. Your control has the intact code book and can reconstruct the message.

If you do not physically destroy the key you just used, then you expose yourself to decryption of past messages if the book is captured.

To get a new code book, you needed to have it delivered somehow, and it was a risky business. So there was the temptation of re-using an old key - and at that point, the OTP cipher stops being perfectly secure. The more you use the same key, the less secure it becomes.

If the enemy intercepts one 2000-character message with key 15273 (using OTP 15273 to 17272) and one 1000-char message with key 16517 (using OTP 16517 to 17516), he has now two sequences from 16517 to 17272 that were encoded with the same characters.

Very simplified model

Suppose we use a base 10 OTP with numbers and imagine we "encode" using modular sum. So 7 encoded by key 5 becomes 7+5 mod 10 = 2.

If you intercept a ciphered "2" you know it was generated by A+B=2, but what was the value of A? What of B? You can't know. Both 7+5 and 8+4 get you 2... actually you have all ten possibilities, and therefore, a perfect cipher. Without knowing the key, the message can be any message at all.

But now you intercept a ciphered "4" and you know it was generated by C+D=4, but due to key reuse, B is the same as D, so you also know that C+B=4.

By subtracting the second relation from the first

A+B = 2
C+B = 4

we conclude that A+B-C-B = A-C = -2, that is, the first message's n-th character and the second message's m-th character differ by 2. Since both messages need to make sense, it is no longer true that they can be any message at all, and with a bit of trial and error you will be able to read both - it's no more complex than Sudoku:

First message                        : ATTACK AT DAWN
Second message shifted using A-C rule: BQF ORXTNABERN <-- 1st msg can't be it

First message                        : HELLO WORLD OF
Second message shifted using A-C rule: QUEAMISH OSSIF <-- now we're somewhere

I believe the problem the Soviets had is that they mistakenly distributed some OTPs to multiple agents to use, it wasn't that they happened to generate the same OTP multiple times. If that happens with any meaningfully long OTP it probably means the RNG isn't very good.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .