I am confused regarding this: I am working on a project but I want to use a one-time pad and want to launch a meet-in-the-middle attack on my new scheme for data security. As block ciphers are vulnerable to meet-in-the-middle attack, I am confused here that single encryption can also vulnerable to this attack. If I launch this, what should I use with one-time pad to resist this attack? Since I am unable to find preventive measures for this attack, can anybody guide me? How does the code meet in the middle for single encryption?

2 Answers 2


Meet-in-the-middle attacks are ways to reduce the effective entropy of multi-pass encryption, where multiple keys are used in a single encryption operation. It's typically relevant to ciphers where the key is broken up into pieces that are used individually and in sequence (as in the 112-bit and 168-bit variants of 3DES a.k.a. TDEA). If the key fragments are individually weak (as DES keys are), then layering multiple uses of them doesn't add as much security as you'd naively think.

This is totally irrelevant to one-time pads! With a one-time pad:

  • There is only one key and it doesn't get broken up or reused.
  • The key is extremely strong (by definition, it's as long as the message, where most ciphers use keys far, far shorter, and it's fully random); even if you for some reason layered two or more one-time pads over the same message, meet-in-the-middle attacks still wouldn't be practical because the effective key is still as long as the whole message.

There's a reason one-time pads are considered literally unbreakable: to an attacker (who hasn't gained any info about the key, and the key hasn't been misused), the message is (absent any clue about its contents) exactly equally likely to be every single possible permutation of all possible values across the whole message length. In other words, if the message is a thousand bytes of data, there are 2^8000 possibilities for the message. Contrast that with DES, where no matter how much data you encrypt, there's only 2^56 permutations of of the data that it could be, because there's only 2^56 possible values for a DES key. Encrypting with DES twice with two different keys (or encrypting with one and decrypting with the other) doesn't double the security, because of meet-in-the-middle, but it's still not any weaker than 2^56. Conversely, encrypting twice with two different one-time pads doesn't add literally any security at all... but it doesn't matter, because the total security is still 2^bitlength, and every single possible permutation of the message is still equally possible.


A one time pad is basically a long shared secret between sender and recipient. It needs to be shared securely between these before any data exchange is done - and of course it should not be shared with a potential attacker. If the latter is guaranteed then the attacker cannot use a man in the middle attack to get access to the encrypted traffic. This is not only true for a one time pad but also for all of modern (secure) symmetric encryption algorithms which rely on a shared secret.

While the man in the middle cannot decrypt the encrypted traffic, it can change it though. This is because one time pad is a very simple encryption mechanism which does not include any kind of message authentication. To fix this, message authentication would need to be added, like with HMAC or digital signatures. Many modern ciphers instead have message authentication already integrated, i.e. provide authenticated encryption.

The need to securely share a secret of at least the same size as a later message and the lack of message authentication makes one time pads usually not suitable for use in the real world.

  • A one-time pad can be useful if you have a guaranteed secure channel now, but will need to send a secure message at some time in the future when you no longer have the channel. For example, a diplomat travelling to a foreign mission.
    – Mike Scott
    Commented Sep 5, 2022 at 7:13
  • I am asking about meet in the middle attack ... not man in middle
    – user282299
    Commented Sep 7, 2022 at 5:41
  • @user282299: if you want to know about attacks at the cryptographic level please use Cryptography, not Information Security. Commented Sep 7, 2022 at 8:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .