# Tag Info

18

There is a great graphical representation of the possible problems that arise from reusing a one-time pad. Reusing the same key multiple times is called giving the encryption 'depth' - and it is intuitive that the more depth given, the more likely it is that information about the plaintext is contained within the encrypted text. The process of 'peeling ...

12

No that is not correct, here is the thing, given a ciphertext say ezcle, there exists a key such that this would decrypt to hello, another key such that this decrypts to harry, another key which will decrypt to frank, another key which will result in world. And every other 5 letter word in the dictionary, and every other 5 letter combination of letters (I'm ...

11

Well, the classical answer to "what is the correct thing to do after you have the XOR of the two original messages" is crib-dragging. That is, you take a guess of a common phrase that may appear in one of the plaintexts (the classical example against ASCII english is the 5 letter " the "), and exclusive-or that against the XOR of the two original messages ...

11

There are two methods, named statistical analysis or Frequency analysis and pattern matching. Note that in statistical analysis Eve should compute frequencies for $aLetter \oplus aLetter$ using some tool like this. A real historical example using frequency analysis is the VENONA project. EDIT: Having statistical analysis of $aLetter \oplus aLetter$ like ...

11

No. This is not safe. The one-time pad requires that the pad be generated by a true-random process, where each bit of the pad is chosen uniformly at random (0 or 1 with equal probability), independent of all other bits. Any deviation from that, and what you haven't is no longer the one-time pad cryptosystem -- it is some kludgy thing. In particular, once ...

8

Would it be useful for companies who need to keep their data safe? No, a one-time-pad is only useful in very rare circumstances. The main issue is key-management. You can only use each pad once, it's as large as the data you want to encrypt, and you need to get it to all parties in a secure way. The direct competition of a one-time-pad is a stream cipher. ...

8

Generating a pseudo-random stream from a key, and XORing that stream with the data to encrypt, is done on a regular basis. That's how most stream ciphers work, e.g. the well-known RC4, and also applies to block ciphers in counter mode. This is not "One-Time Pad", by definition, since OTP requires the key stream to be truly random (that's the condition from ...

8

The perfect security of OTP hinges on the fact, that keys must be chosen truly at random and uniformly from the domain of all possible keys, i.e. all bitstrings of a certain length. The problem with your approach is that you use a pseudorandom number generator to generate the key. It does not matter how good the generator is, because the entropy that can be ...

7

Yes, encrypting two different random "plain texts" with the same "pad" is indistinguishable from using two different random one time pads for encrypting the same plain text. You get perfect secrecy in the latter case, so you will get it in the former case as well. However, usually there is a functional difference between the key and the plain text that the ...

6

In general, knowledge of $m_1 \oplus m_2$ is not enough to uniquely determine $m_1$ and $m_2$, even if both are known to be, say, English text. For a simple example, $$\text{"one one"} \oplus \text{"two two"} = \text{"one two"} \oplus \text{"two one"}.$$ However, in practice it may be possible to obtain fairly good guesses for $m_1$ and $m_2$; the typical ...

6

Short answer: Don't do this. The security proof for the One Time Pad requires the use of a True Random Bit Generator. The best you can find on a typical multipurpose system without dedicated hardware support for a TRBG is a Cryptographically Secure Random Bit Generator. The difference is that CSRBG is typically a deterministic algorithm that is seeded with ...

6

The name I would use for this protocol is "broken". It is insecure. An eavesdropper gets to observe $Q_0 = P \oplus CM$, $Q_1 = Q_0 \oplus SM = P \oplus CM \oplus SM$, and $Q_2 = Q_1 \oplus CM = P \oplus SM$. Notice that we have the relation $$Q_0 \oplus Q_1 \oplus Q_2 = (P \oplus CM) \oplus (P \oplus CM \oplus SM) \oplus (P \oplus SM) = P.$$ Therefore, ...

6

The bits are not independent from each other, at least within an individual song, so the pad is not truly random, thus this is not a one-time-pad. Perhaps a hash-based approach would fix this, but... ... there are a limited number of songs available, a simple attack would then be to enumerate every song (in the same format you describe) and try to decrypt a ...

6

No, OTP would not be considered a cryptographical hash function. OTP takes a key; cryptographical hash functions don't It's generally expected that the output of a hash function be of fixed length, independent of input length. The output of OTP is the same length as the input. Hash functions are deterministic (that is, if you give the same input twice, ...

5

First of all, a terminology nit: please don't say "a One-time-pad generated by a CSPRNG"; a one-time pad must, by definition, be generated randomly, and an important part of its security proof is that it was generated randomly (and so an attacker cannot disqualify any potential pad, even if that attacker had infinite computational resources). ...

5

If you use a CSPRNG to generate the pad, you're not using a one-time-pad anymore by definition since the pad is no longer random, so the question as stated is incorrect with respect to terminology. The advantage of using stream ciphers is that you no longer have the key distribution problem the OTP has, since your key is now only a few dozen bits long, and ...

5

If you encrypt the messages $m_1$ and $m_2$ with the pad $p$ as \begin{aligned} c_1 &= m_1 \oplus p, \\ c_2 &= m_2 \oplus p, \end{aligned} where $\oplus$ denotes the binary operation of a finite group (e.g. addition on integers modulo $n$, or XOR on bitstrings, etc.) and $p$ is a random element of the group, then, indeed, an attacker who ...

5

There is no universally accepted definition of the expression "stream cipher"; but the one I most often encounter is the following: a stream cipher is a symmetric encryption algorithm which accepts as inputs arbitrary sequences of bits (or bytes) such that: the length of the output is equal to the length of the input (no padding); for any $n$ (possibly any ...

5

In few words: OTP has perfect secrecy; For a cipher to have perfect secrecy, it is required that $|K| \ge|M|$. Let $K=M=C=\{0,1\}^n$ be the set of keys, messages and ciphertexts. If you apply the "improvement", ie, if you remove $0^n$ from the keyspace, then you've created a cipher that cannot show perfect secrecy (because now $|K| = |M| - 1 < |M|$). ...

5

Firstly, I presume this is not something you are going to use for protecting data in any kind of real life scenario, but are only asking out of curiosity. Secondly, just to get the terminology straight and avoid confusion, what gives an OTP cryptographic scheme information theoretic security is that it meets both of the following two criteria: The key ...

4

No it cannot be used to create an OTP as the technical definition of OTP requires that the pad be truely random and the output of PBKDF2 is not true random, only pseudo-random. Of course you can generate a large pad from a password and xor it with your random plaintext. What you lose though are strong security guarantees. AES has been hammered at by really ...

4

One important difference between the one-time pad and a stream cipher is the proof of security of the one-time pad. Shannon proved that the one-time pad provides perfect secrecy. He also provided another proof that is interesting to this dicussion. His proof was that no cipher can provide perfect secrecy unless the key is at least a long as the message. ...

4

A recent (2006) paper that describes a method is "A natural language approach to automated cryptanalysis of two-time pads". The abstract: While keystream reuse in stream ciphers and one-time pads has been a well known problem for several decades, the risk to real systems has been underappreciated. Previous techniques have relied on being able to ...

4

Don't. Just don't. You are indeed perceptive enough to note that if the output of PBKDF2 is truly pseudo-random, then XORing it onto data is as secure as the password is. But don't. Really. It's not good hygiene. A KDF is a Key Derivation Function, not a cipher. It's not designed to be used as a cipher, so don't use it as one. Use it to derive keys that you ...

4

You should not use the raw data of any image as a one time pad. This is even worse with an image of a sky, because of the large amount of blue pixels. For all images, adjacent pixels tend to be the same colour - which means there is a large amount of repetition. If you want to use some of the data of the image as a one time pad, you will need to condition ...

4

One-Time Pads only protect secrecy Encrypting with a one-time pad only protects the secrecy of the message. It does not protect the integrity of a message. An attacker can flip bits in the cipher-text and that will flip bits in the plain-text. To protect the integrity of the message you need some sort of Message Authentication Code (MAC). This can be done ...

4

Only two people can communicate with each other with the chat program. No group conversations. This is fairly limited, but let's admit. The people will be communicating over the internet. So, an insecure channel. OK. The chat program will just handle basic characters, numbers and symbols that are on a standard US keyboard. This is to keep ...

3

The reason repetition is so dangerous is imagine trying to attack a worst case scenario: a BMP picture file that contains all black. The contents of the image file will be #000000 #000000 #000000 #000000 ... Now consider how a one-time pad works: it XORs the cleartext with the bit stream. So if your plaintext was "ATTACK ON 10 SEPT", and you XORed it ...

3

The amount of randomness in common pictures has actually been studied thoroughly, just not for applications to encryption, but rather for stenography. An artifact of images is that the least significant bit (it is what changes between slightly different shades of blue) has the highest entropy. A simple stego-system is to overwrite the least significant ...

3

You would retain perfect security in the situation you described. Consider your question in reverse. Use the ciphertext as a OTP and use the n-time-pad as the ciphertext. Since your ciphertexts are random their concatenated result is also random and would qualify as an OTP. At this point is doesn't matter what the OTP was, the conditions for perfect ...

Only top voted, non community-wiki answers of a minimum length are eligible