The three golden rules and the reuse disaster

The perfect security of the one-time pad is conditional on three strict rules. Breaking any one of them causes Shannon's entire guarantee to collapse. The third is the most subtle — and the most often violated in real history.

The three golden rules

1. The key must be truly random. Each bit of the pad must be unpredictable, drawn from a physical source of randomness. A predictable pseudorandom generator ruins Shannon's proof.
2. The key must be as long as the message. A byte of message requires a byte of key. No shortcut: a shorter key that is repeated is no longer a one-time pad.
3. The key must NEVER be reused. Hence the name one-time: each pad is used only once, for a single message, and then it is destroyed.

The reuse disaster

What happens if we violate rule 3 and encrypt two messages M1 and M2 with the same key K? This is called, ironically, a two-time pad. The attacker intercepts the two ciphertexts and combines them with XOR:

C1 = M1 XOR K
C2 = M2 XOR K

C1 XOR C2 = (M1 XOR K) XOR (M2 XOR K)
          = M1 XOR M2 XOR (K XOR K)
          = M1 XOR M2 XOR 0
          = M1 XOR M2

The key cancels out. The attacker obtains M1 XOR M2, a combination of the two plaintexts that no longer depends on the key at all.

Why this is catastrophic

M1 XOR M2 leaks a huge amount of information. Natural-language messages are highly redundant: word structure, frequent letters, spaces. By exploiting this redundancy — a technique called crib dragging — one can often separate M1 and M2 without ever knowing K.

        Two messages, a single reused key
        ---------------------------------------
   C1 ─┐
       ├─ XOR ─►  M1 XOR M2   (the key has vanished!)
   C2 ─┘             │
                     ▼
            redundancy analysis
            (frequencies, spaces, probable words)
                     │
                     ▼
              M1 and M2 recovered

This is not theoretical. The VENONA project allowed American services to decrypt Soviet telegrams precisely because, under pressure, operators had reused pages of pad. Rule 3 had been broken.

In summary

• Perfect secrecy requires three rules: a truly random key, as long as the message, and never reused.
• Reusing a key (two-time pad) is fatal: C1 XOR C2 = M1 XOR M2, the key cancels out.
• The result M1 XOR M2 leaks the plaintexts through their redundancy, without ever breaking the key.
• History confirms it (the VENONA project): the theory is perfect, but the slightest deviation destroys it.