Capstok — learn by doing

Why this matters

Gilbert Vernam's 1917 patent described a cipher that XORed a teleprinter tape of the message with a tape of random key characters — the first mechanised one-time pad and the first time anyone built encryption around the XOR operation. XOR is the fundamental operation of all modern symmetric cryptography for two reasons: it is its own inverse (encrypt and decrypt are the same circuit), and it is information-theoretically the only operation under which a uniformly random key bit produces a uniformly random ciphertext bit. Every stream cipher (RC4, ChaCha20, AES-CTR) is a Vernam cipher whose 'random tape' is replaced by a deterministic pseudorandom keystream. Understanding why XOR sits at the heart of this design — and what goes catastrophically wrong when you reuse the keystream (the so-called 'two-time pad') — is essential for understanding the long history of stream-cipher disasters from Venona to WEP.

Demo

The Vernam cipher operates bit by bit: each plaintext bit is XORed with the corresponding key bit. With a fresh random key per message it is a one-time pad; with a deterministic keystream from a short key it is a stream cipher. Either way, the encrypt and decrypt operations are identical — XOR is an involution.

C = P \oplus K \qquad P = C \oplus K \qquad C_1 \oplus C_2 = P_1 \oplus P_2 \text{ if } K \text{ is reused}

Try it yourself

Verify that vernam(vernam(pt, k), k) == pt for any pt, k of equal length — this is the involution property that makes XOR encryption symmetric.
Encrypt two short ASCII messages of equal length with the same key, then compute ct1 XOR ct2 and confirm it equals pt1 XOR pt2 without using the key.
Given a known pt1 and a leaked pt1 XOR pt2, recover pt2 — this is exactly how the Venona project broke reused Soviet OTPs in the 1940s.
Generate a 1 KB random keystream and use it as a stream cipher to encrypt a paragraph; confirm that ct ⊕ keystream recovers the paragraph exactly.
Show empirically that XOR with a uniformly random byte produces a uniformly random output byte: encrypt 0x00 ten thousand times with random keys and verify the ciphertext byte distribution is flat.

References

// main.go — run: go run main.go
package main

import (
	"crypto/rand"
	"fmt"
)

func vernam(data, key []byte) []byte {
	out := make([]byte, len(data))
	for i := range data {
		out[i] = data[i] ^ key[i]
	}
	return out
}

func main() {
	// Single-message Vernam (= OTP)
	pt := []byte("the quick brown fox")
	key := make([]byte, len(pt))
	rand.Read(key)
	ct := vernam(pt, key)
	if string(vernam(ct, key)) != string(pt) {
		panic("round-trip failed")
	}

	// The "two-time pad" disaster: reusing the same key for two messages
	pt1 := []byte("attack at dawn 06")
	pt2 := []byte("retreat at noon00")
	ct1 := vernam(pt1, key[:len(pt1)])
	ct2 := vernam(pt2, key[:len(pt2)])

	// Attacker computes pt1 XOR pt2 with no knowledge of the key
	leaked := vernam(ct1, ct2) // this is pt1 XOR pt2
	fmt.Println("pt1 XOR pt2:", leaked)

	// If the attacker guesses any portion of pt1, they get pt2 for free in that range
	guess := []byte("attack at dawn 06")
	recoveredPt2 := vernam(leaked, guess)
	fmt.Println("recovered pt2:", string(recoveredPt2))
}

Run: go run main.go

Why Encryption Runs on XOR (the Vernam Cipher)

Why this matters

Demo

Try it yourself

References