Hot answers tagged

33

Brute force on OTP will give you all sorts of messages which are meaningful and not meaningful. For example, you have a 4-character encrypted text: weaw. Now brute-forcing will give you all sorts of meaningful and not meaningful messages like: erwe hell road .... Now, which one was the real message? That would be difficult, rather impossible to guess.


20

What you are missing is the fact that every resulting message is equally possible. There is no way to verify that any of the resulting messages was indeed the message that was sent. If you have $P_1P_2P_3P_4 \oplus K_1K_2K_3K_4 = C_1C_2C_3C_4$ where each $P$, $K$ and $C$ are one bit, then $C_1C_2C_3C_4$ can have any value possible. Now assume your brute ...


19

Modern security has moved beyond looking just at passive attacks (in which the attacker is just a passive eavesdropper seeking to learn what was said); attackers are generally considered to be able and willing to pull off active attacks of various types (in which the attacker can modify or forge messages to achieve some goal). One-time pads are extremely ...


13

First you have to understand why it is possible to do exhaustive key searches on other systems. Suppose you have a plaintext of length n, ciphertext of the same length n, and a key of length k (all in bits). Then by trying all possible keys we obtain at most 2k candidate plain texts. If the system has some kind of validation or message integrity built into ...


11

You've actually been trapped by the mindset that OTP will hide all information about the underlying plaintext. This is not true as you have observed. The definition of perfect secrecy, given in Introduction to Modern Cryptography by Katz-Lindell, reads like this: Definition 2.3 An encryption scheme $(\text{Gen, Enc, Dec})$ with message space $\mathcal ...


7

The bottom line answer is this: every possible 5-character ASCII string is equiprobable. Therefore, if you try all possible keys (which is practical, as you noticed), then you will certainly see the correct plaintext string at some point. But you will have no way to know that the correct string is the correct string. To make this painfully clear, consider ...


6

No, that doesn't work. OTP is secure because knowledge of the plaintext doesn't give you any useful information about the key. This is because the bits of the key (e.g. $P_0$) are never used to encrypt anything else. If you would somehow reuse the key then leakage of the plaintext would cause leakage of $P_0$. Leakage of $P_0$ directly leaks $P_1$. I.e. ...


5

In a lot of cases OTP will be completely impractical. If instead of a truly random pad you use a pseudo random pad, you will have something a lot more practical. But it is no longer OTP, and the security proofs about OTP means nothing in that case. I think this is the essence of the Bruce Schneier quote you mention. If we for a moment ignore the impractical ...


5

fkraiem's answer is correct, but more context is required, in my opinion. The one-time pad (the theoretical device) has not been broken. But real-world systems based on the one-time pad have failed in practice. Systems based on one-time pads have failed in the past because key material has been reused, either by mistake or because the sender had ran out of ...


5

We know, by the encryption rule for one-time pads, where $k$ is the re-used pad: $p_1 \oplus k = c_1$ and $p_2 \oplus k = c_2$. For $\oplus$ (xor) the following arithmetic is valid: $a \oplus a = 0$ for all $a$ (everything is its own inverse), which is clear from truth tables, e.g., and $a \oplus (b \oplus c) = (a \oplus b) \oplus c$, i.e. the operation ...


5

By two-time pad I assume you mean using a one time pad key to encrypt two messages. Lets say $K$ is the key and $m_1, m_2$ are your messages. Then from the ciphertexts $c_1 = m_1 \oplus K$ and $c_2 = m_2 \oplus K$ an adversary could trivially learn information such as $x = c_1 \oplus c_2 = m_1 \oplus m_2$. Whether or not this information is "exploitable" may ...


4

This cipher is called a one-time pad. It is unbreakable ("perfect secrecy") assuming that: The pad (the collection of random bits) really is truly random The pad is never reused to encrypt other messages So, no information can be extracted from $\text{file} \oplus \text{random bits}$. The basic idea of the proof is that an attacker can test every ...


4

I believe you need a few clarifications to answer this question yourself. The first is the one time pad (OTP). This is the only truly unbreakable system if it's used correctly. Using correctly means that for every symbol of the message there is exactly one truly random symbol in the key. Specifically, this means that there is no chosen symbol of the key ...


4

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? No. (Please keep reading…) A single mathematical formula won’t cut it. That’s where cryptographic algorithms come in. There are more than a handfull of cryptographically secure ...


4

There is no security difference. Of course, purely random characters with entropy rate $\log M$ where $M$ is the size of the alphabet should be independently generated and used for the OTP, whatever the size $M$ of the alphabet.


4

First things first: what you are describing there is not a one-time-pad! As I explained in another answer of mine: Per definition, OTP requires the “key“ to be… a truly random one-time pad value, generated and exchanged in a secure way, at least as long as the message, and only to be used once. What you describe (eg: using a key ...


4

What you propose is equivalent to trying to do cryptanalysis without any cipher text or other material. Equivalently, you could just take the small plaintext seed that you know, and nothing else, and run it through a probabilistic language model to predict the most likely message. (e.g., a Markov chain text generator). Obviously, it doesn't get you very ...


4

You stated: "I can at the very least narrow down the list of possibilities." Here's an example of why OTP is perfect secrecy, and why your statement, although true, doesn't matter. I have a sentence which I wrote, and after encrypting it with an OTP, it looks like this: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Good luck decrypting that! ...


4

There is no security difference; there are a handful of practical ones: With xor, you can have the same code to do encryption and decryption With xor, you don't have to pick a 'word size'; a larger CPU can handle 4 or 8 bytes at a time, while a microcontroller can handle 1 byte at a time, without changing the ciphertext With xor, you don't have to worry ...


4

Here's my understanding of the encryption process you're talking about: You take a random number $r$, and compute $t = r \bmod n$ You concatinate the two numbers $r$ and $t$, and express the concatination as a bitstring $u$ You then xor that bitstring $u$ with a secret bitstring $s$ You do the same for two different random numbers $r$ and $r'$, using the ...


4

As long as the keys $K_i$ are only used once, this is semantically secure. To see it, observe that if $K_i$ is a uniformly random value in $\{0,1\}^{|M|}$ then so is $C_i = M \oplus K_i$.


4

Your first sentence is entirely wrong. A OTP is a theoretical construct that requires a fully random key (at least) the size of the plaintext. Limiting the amount of random bits to 256 will by definition not be an OTP - at least not for constructions that accept a plaintext larger than 256 bits. The same idea is that if you use a key called $i$ which is ...


3

$c_2 \: = \: m\oplus k_2 \: = \: m\oplus k_1 \oplus k_1 \oplus k_2 \: = \: c_1 \oplus k_1 \oplus k_2$ $k_1 \oplus k_1 \: = \: 00000...00000$ Since fixing either argument turns xor into a bijection, the distribution of $\: k_1 \oplus k_2$ is uniform on non-zero strings. $\;\;\;$ Thus, knowledge of $c_1$ is enough to sample from $c_2$'s distribution, so ...


3

In order to achieve very high security for privacy, would it be cryptographically secure to use one time pad ciphers in emails? OTP offers perfect secrecy, so if it's feasible to use it, it is secure. However, OTP alone offers no authentication and leaves the message malleable. If Alice sends a message Y to Bob, standing for 'yes', Mallory can guess ...


3

Sorry, I would only give partial points for a CCA attack on this scheme. The answer by @SEJPM is of course correct (and very informational so it's good it was posted). However, it is not the "best" answer, since this scheme can be easily broken under a chosen-plaintext attack. I will not write the full answer out (so that I can leave some work to be done for ...


3

This scheme follows the KEM/DEM approach of contructing secure asymmetric encryption schemes. However for a KEM/DEM PKCS (public key cryptosystem) to be secure it is required that both the key encapsulation mechanism (KEM) and the data encapsulation mechanism (DEM) are CPA or CCA secure for CPA or CCA of the whole scheme. Indeed the DEM looks CPA secure as ...


3

First things first: a PRNG (Pseudo Random Number Generator) can not provide a one-time pad. As a reminder: a one-time pad… has to be truly random, must be at least as long as the plaintext, is never reused in whole or in part, and is kept completely secret. Only when all four points are met, we´re talking about OTP. Your PRNG idea fails to meet those ...


3

The security notion one usually considers for OTP is perfect secrecy, which informally means that the ciphertext does not reveal any information about the original message, regardless of the computational power of the adversary. It is already known that this requires that the key size must be equal to the plaintext size and that all keys are equiprobable. ...


3

I just came across this question and was surprised that no one referenced the paper: A Natural Language Approach to Automated Cryptanalysis of Two-time Pads by Mason et al. at ACM CCS 2006. This shows how to solve this problem in an automated and intelligent way.


3

No, it's not secure; after three messages, the attacker can gain information about the second and third messages. To review this in greater detail, lets look at your proposal, and what it actually exposes to the user: To start with, you have a secret $x_0$ and $y_0$ (I'll subscript them to distinguish the values between the iterations). To encrypt the ...



Only top voted, non community-wiki answers of a minimum length are eligible