= Solution
Let $s=k\oplus\operatorname{rev}(k)$ be the effective mask. For each position $i$,
$$
s_i=k_i\oplus k_{n+1-i}=s_{n+1-i}.
$$
Thus the mask is always a <palindrome>, even though $k$ itself is uniformly random. The <exclusive or> of the <ciphertext> bits in a mirror pair is
$$
c_i\oplus c_{n+1-i}=x_i\oplus x_{n+1-i},
$$
because the equal mask bits cancel. The observer learns the corresponding <plaintext> parity exactly. If $n$ is odd, the middle mask bit is also zero, so the middle <plaintext> bit is exposed directly.
An explicit failure of <perfect secrecy> works for every $n\ge1$. Choose $X$ uniformly from $0^n$ and $10^{n-1}$. For $X=0^n$, the <ciphertext> is a <palindrome> with <probability> one. For $X=10^{n-1}$ and $n\ge2$, toggling just the first bit breaks the mirror equality, so the <ciphertext> is a <palindrome> with <probability> zero. For $n=1$, the effective mask is zero and $C=X$. Observing $C$ therefore distinguishes these two messages perfectly.
$$
\boxed{C\oplus\operatorname{rev}(C)=X\oplus\operatorname{rev}(X):\ \text{plaintext structure leaks}.}
$$
There are only $2^{\lfloor n/2\rfloor}$ possible effective masks, each equally likely. Hence even a fresh $n$-<bit> key supplies at most $\lfloor n/2\rfloor$ independent masking bits in this construction. Choosing a long, uniform, one-use key is insufficient if the <encryption> transformation collapses its randomness.
\Image[/past-exam-of-the-computer-science-course-of-the-university-of-oxford/2015/security-2015-mirror-mask.png]
{title=Mirror-paired mask bits cancel, exposing the plaintext parity in each pair}
Back to article page
