True. Double-xor reduces to simple-xor, but with a key that's as long as the product (LCM, actually) of the original subkey lengths. Simple-xor is an unbreakable one-time pad if the key is as long as the message*. The technique above can often break a double-xor message with much less ciphertext than the LCM of the subkey lengths.
* and if the key isn't reused for another message, and if the key isn't guessable for some other reason, yada yada. | [reply] |