Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The symmetric cryptosystem One time pad (OTP) seems to be very beautiful since it is perfectly secret according to Shannon. Many books, however, point out that the main drawback is that one must create a secret key of length as the plaintext. For this reason the concept of perfect secrecy is nowadays abandoned, and we prefer other types of cryptosystems.

Now for example suppose I want to encode my text message with the ASCII scheme, and moreover suppose that this plaintext occupies 10 gigabytes, thus (using OTP) also the key occupies 10 gigabytes. I think however this is a ''sustainable price'' because on the other hand I'm sure that the ciphertext is can't be attacked.

Practically, I don't understand why having such long keys with OTP is a big disavantage even if we reach "the dream" namely the perfect secrecy . Nowadays the storage of informations is very easy, so where is really the problem? I can for example share the "long key" with a physical meeting!

Thanks in advance

share|improve this question
Physical meetings in a globalised world are often not that practical and as poncho says we have cheaper and far more practical alternatives at the cost of computational privacy. But to be honest, we rarely have that important messages that need to stay confidential until our sun ends up in a beautiful supernova :) – DrLecter Apr 17 '14 at 19:48
up vote 8 down vote accepted

Actually, the problem with OTP isn't the storage of the pad (although secure erasure of the parts of the pad you used is trickier than it looks), and it isn't the pad generation (although, again, that's trickier than it looks), but the secure transport.

After all, it's not enough for you (Alice) to have the secure pad, you also have to give a copy to the guy (Bob) you're sending the message to, and you need to send it in a way that's secure.

That's the real reason OTP's aren't used that often; OTP's would require meeting with the other side directly, or alternatively using a trusted courier; we rarely want to put up with the expense with either, especially since there are cheaper alternatives available.

share|improve this answer
Since the pad is at least the same size as the message, then if you have a secure channel to transmit the pad, you can often use the same channel to transmit the message itself, and not bother with the pad at all. OTPs are sometimes used when the pad transmission is simple (hand a memory stick to your spy) but the later message transmission is difficult (transmit the secret enemy plans). – rossum Apr 19 '14 at 10:48
@rossum: What you say is true; however I didn't raise that issue because the secure channel may have significant latency (e.g. require a physical meeting), and you cannot tolerate that latency when sending the actual message; hence OTP may be useful that way. That said, conventional crypto also does the same thing, and generally in a more useful way. – poncho Apr 21 '14 at 22:55
There are many situations in which one may temporarily have access to a secure means of conveying information (e.g. the other guy may be in the room at the moment) but might not have at that time the information to be sent; later, one might acquire the information to be sent but no longer have access to a secure means of conveyance. Other means of cryptography are more convenient than OTP while being essentially as secure; OTP has insufficient advantage to justify the reduced convenience, but would be practical if other means of security were available. – supercat Nov 13 '14 at 23:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.