= Solution
Perform every addition in the <finite field> $\mathbb F_2$. From the two transmitted strings $c_i=a_i+k_i$ and $d_i=a_i+k_{i+1}$ one obtains
$$
c_i+d_i=k_i+k_{i+1}\qquad(1\leq i\leq N).
$$
Choosing one candidate value of $k_1$ recursively determines $k_2,\ldots,k_{N+1}$, and hence determines the candidate plaintext $a_i=c_i+k_i$. There are only two candidates: changing $k_1$ complements every recovered key bit and every plaintext bit. The information that the message makes sense normally selects the intended candidate.
Once this ambiguity is resolved, any other ciphertext positions encrypted with the recovered segment $k_1,\ldots,k_{N+1}$ can be decrypted. Key bits outside that segment remain <independent random variables>[independent] and uniformly distributed, so this mistake gives no information about messages using only those bits. This is the <two-time pad attack>: reusing related one-time-pad key material destroys <perfect secrecy>.
Back to article page
