# Tag Info

11

Very short answer: No Quite Short answer: No, because a scheme can only be a One-Time-Pad if the entire pad is perfectly random and secret. Concise answer: It sounds like you're trying to build a stream cipher. The security of it really comes down to how much of the scheme you think can be kept secret. If I listen in to your wifi and hear you requesting a ...

9

Actually, one-time pad can be implemented on the basis of any finite group operation; with these requirements: The pad must consist of random group members; that is, each element in this pad must have equal probability of being any specific group member, and there must not be any correlation between different entries within the pad. The encrypt and the ...

8

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices. Your scheme: A->B: $c_1 = m \oplus a$ B->A: $c_2 = c_1 \oplus b$ A->B: $c_3 = c_2 \oplus a$ B computes $m = c_3 \oplus b$ an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can ...

7

It is quite simple and stems from the idea that flipping one bit in the ciphertext flips the corresponding bit in the plaintext. So, say the ciphertext is $1011$ and we know the plaintext is $0101$ (thus the key is $1110$). Say we want a plaintext of $0000$, we just have to change the ciphertext to $1110$ (notice where the bits have been flipped) and we ...

6

In the "Telegraphic Code to Insure Privacy and Secrecy in the Transmission of Telegrams" from 1882, Frank Miller assigned a number to around 14,000 code words. Bankers would select an "irregular" series of such words and exchange them with a remote partner. Any messages would be lined up below the next unused words on the pad for encoding. When you lined up ...

6

Let's say Alice and Bob have $c$ bits of pre-shared secret key material. Alice generates $a$ bits of new key material, concatenates it to a message $M$ that is $b$ bits long, and uses $a+b$ bits of their pre-shared key material to encrypt "message||new-key". She sends this secure message to Bob, who decrypts it with the shared key. Now they both have $a$ ...

6

What you've described is generally called a "book cipher" or "Ottendorf cipher", where the "key" is knowing which publication is being referenced, as well as the algorithm for recovering information from it. A hundred years ago they were quite secure because not only were books fairly rare, but trying every book against an unknown cipher was very time ...

5

If "this message" is the plaintext, then that doesn't actually help, since encrypting the new secret key uses up an amount of the old pad equal to the length of the new secret key, the total length of all "actual messages" will still be limited to the total length of the original one-time pad. If "this message" is the ciphertext, then an eavesdropper will ...

5

There are four concerns here: Pad generation Pad transmission Message privacy Message authenticity Pad generation The security of the one-time pad depends on the assumption that the pads are generated from a truly random source. This is actually quite a big ask. Suppose for a moment that you want to exchange a 4 gigabyte pad. Let's say your RNG does ...

5

What do you mean 'a one time pad with a password'? One time pads don't take passwords, they take samples of truly random data as long as the message. If what you're doing is taking the password, repeating it N times, and using that as if it were a random one-time pad, well, that can usually be broken even if you don't send a second message. If what you're ...

5

Assuming that you have not used the one-time pad bits $k_2, ..., k_{N+1}$ to encrypt another message, then the answer is no, the attacker cannot determine the message. This can be seen by using the normal proof of One Time Pad's security; the bits $k_2, ..., k_{N+1}$ are random and uncorrelated to any other bits the attacker has access to; hence the ...

5

Actually, the problem with OTP isn't the storage of the pad (although secure erasure of the parts of the pad you used is trickier than it looks), and it isn't the pad generation (although, again, that's trickier than it looks), but the secure transport. After all, it's not enough for you (Alice) to have the secure pad, you also have to give a copy to the ...

4

The system you describe is not a one-time pad, it is a stream cipher, and a bad one for that. A one time pad has real (truly) random bits in the XOR pad, which are never reused for two messages. "Their" cipher has a pseudorandom pad (with non-crypto PRNG), and if I understand right, even the same one for each message. Even a real random one-time-pad is ...

4

Here since the key is used more than one time, an attack called Crib-Dragging can be used to attack the cipher text. A blog post which could give you a greater understanding on the implementation part is located at travisdazell.blogspot.in/2012/11/many-time-pad-attack-crib-drag.html: Many Time Pad Attack - Crib Drag The one time pad (OTP) is a ...

4

In the method you reference, I believe that the XOR details are irrelevent, given the following fact: For your method to be a one time pad, the key must be random and as long as the message. This gives the method special characteristics such as "perfect secrecy": http://en.wikipedia.org/wiki/One-time_pad#Perfect_secrecy In the method you reference, the ...

4

Well, for one thing, you are not using a "One Time Pad". A "One Time Pad" means, by definition, that someone generates a pad of numbers using true randomness (and not algorithmicly), and that no potential adversary has any information on what that pad may contain. Then, that pad is given to both the sender and the receiver, and then the sender uses it to ...

4

All of the responses so far have answered your question, but it is interesting to note that this method of collecting random mouse movements has been implemented before by a commercial Certification Authority. I speak from first hand experience of using this, because I worked for the company the created it. Baltimore Technologies (now Verizon Enterprise ...

4

If your key material is properly random and at least as long as that which is to be encrypted, and indeed each key is used only once, then one-time pad is indeed applicable. As was noted: Distribution of keys will be a hard problem. OTP makes practical sense only in scenarios where keys can be distributed at some time T, then used for encrypting and ...

3

You can construct a one-time MAC that has a similar properties to the OTP. Better still, it uses a fixed number of bits for each message. Here's how it works. Choose the closet prime to your message block size. Let's say you plan to process 128-bit chunks of your message. Let's say there are $L$ such blocks. The first job is to pick the first prime larger ...

3

(The below may be a bit cryptic if you don't know Python.) The idea is not to decode the message, but to manipulate it. Since your ciphertext is C = OTPkey ^ "attack at dawn" all you need to do is to XOR the last 4 bytes of the ciphertext with the original text "dawn" and then again with "dusk", for example: C ^ "attack at dawn" ^ "attack at dusk" ...

3

Each zero in m1⊕m2 indicates a matching character. These are known as coincidences. The number of coincidences can possibly indicate what language they are communicating in since different languages have a different character frequency distribution. (Random data should have coincidences 1/26 of the time if using only lowercase letters, whereas English should ...

3

The answer to this question follows directly from the answers to Should we MAC-then-encrypt or encrypt-then-MAC? and the comment thread here. In short: Your scheme is computationally secure (IND-CCA2 and INT-CTXT) assuming that HMAC is a computationally secure privacy-preserving MAC; but your scheme is wildly impractical, as fgrieu explains, so it is not ...

3

Perfect Secrecy (or information-theoretic secure) means that the ciphertext conveys no information about the content of the plaintext. In effect this means that, no matter how much ciphertext you have, it does not convey anything about what the plaintext and key were. It can be proved that any such scheme must use at least as much key material as there is ...

3

In modular calculations such as this, the divisor (in your case 26) must be at least the size of your character code space. Your code space is 46 characters, so that is not going to work. Any output of the modular calculation will be less than the divisor, so you will never get 83 for x mod 26, it is not going to happen. For a 46 character code space, 46 is ...

2

It works with modular-arithmetic-based one-time pads as well. If somehow we know this part of a ciphertext… HZIVQ JJGTY GKBSI IWMVV HIYTA YHHDV XLBOK O …we can decrypt it to this message… MEETJ ANEAN DMETO MORRO WATTH REETH IRTYP M Then the key would have to be this: UUDBG IVBSK CXWYT VHUDG KHEZS GCCJN OTHPU B You can verify this by entering the ...

2

If you know the plaintext and the ciphertext, getting the key is trivial. $$c=m \oplus k$$ Try moving the terms around. Hint: $m$ and $k$ can be functionally swapped (change position with each other), ie. only one term needs to be secret. You already know one term. I've pretty much given you the answer. About the decoding procedure: The ASCII table ...

2

You can use PBKF2 key generation function. Use some integer generated by the mouse movement as the input. PBKF2 function will give you a random output with more entropy than the input.

2

As well as Simon Johnson's suggestions you should think about the following: When collecting the entropy you'll need to ascertain the speed at which the hardware random number generator provides entropy. The collection program may need to be in a loop so waits for more entropy to become available (similar to /dev/random). Think about other sources of ...

2

The OTP is more a theoretical construction than a real world construction. The OTP suffers from three core problems: Key Generation. Key Distribution. Key Destruction. Let's deal with each one in turn. Key Generation Key generation is surprisingly difficult. In order to get the full security proof for the OTP, you need to each bit to be independent of ...

2

One can efficiently obtain a $\:GF\left(2^n\hspace{-0.02 in}\right)\:$ either by $\;$ looking up the simplest binary irreducible polynomial of $\;$ degree $n$ here and verifying that it is in fact irreducible $\;\;\;$ or $\;$ using this unconditional and deterministic algorithm to compute such a polynomial . For any such \$\:GF\left(2^n\hspace{-0.02 ...

Only top voted, non community-wiki answers of a minimum length are eligible