Past exam of the mathematics course of the University of Cambridge / 2020 / ii / Paper 4 / 3I / b / Solution

Perform every addition in the finite field ${\mathbb{F}}_2$. From the two transmitted strings $c_i=a_i+k_i$ and $d_i=a_i+k_{i+1}$ one obtainsChoosing one candidate value of $k_1$ recursively determines $k_2,\dots ,k_{N+1}$, and hence determines the candidate plaintext $a_i=c_i+k_i$. There are only two candidates: changing $k_1$ complements every recovered key bit and every plaintext bit. The information that the message makes sense normally selects the intended candidate.

Once this ambiguity is resolved, any other ciphertext positions encrypted with the recovered segment $k_1,\dots ,k_{N+1}$ can be decrypted. Key bits outside that segment remain independent and uniformly distributed, so this mistake gives no information about messages using only those bits. This is the two-time pad attack: reusing related one-time-pad key material destroys perfect secrecy.