How to cryptoanalyze a one time pad that uses a plain text document as the pad?

Question

I have read that in order for a one time pad to be truly secure, the pad itself must be random data. Given the practical difficulty of sharing a secure random pad, I was wondering what would be the problems with using the vast multitude of plain text documents that are currently available from the web.

For instance, if you had some prearranged pattern for selecting a document between Bob and Alice. Box uses one such document from the web, say a project Gutenberg file, and pads his message (UTF8) with that document and sends the encrypted file to Alice.

What process could Eve use to decrypt the message?

Assume that the pad is longer than the message, and that no other messages between Bob and Alice use the same pad, but other web documents that they mutually agreed upon.

Given the vast number of tracts of text this seems like it could be a practical source for one time pads. But I have a nagging suspicion that the basic language pattern in the pad could cause an issue.

Answer 1

Well, first of, the number of files in the project Gutenberg, though vast by human standards, is really small for a computer, so it is workable to simply try them all.

Apart from that remark, non-random pad data implies biases. If both the plaintext and the pad are "natural language texts", then the question becomes: given m XOR m', where both m and m' are "text", how can we recover m and m' ? This problem is equivalent to the infamous "two times pad", where a (truly) random pad p was used, but unfortunately twice, with two distinct messages m and m'. In the "two times pad" problem, the attacker knows m XOR p and m' XOR p; by XORing these two values together, the attacker obtains m XOR m' and proceeds from that. In your case, the encrypted text is already m XOR m', so the same attack method applies.

See this and that for details.