# Tag Info

19

Modern security has moved beyond looking just at passive attacks (in which the attacker is just a passive eavesdropper seeking to learn what was said); attackers are generally considered to be able and willing to pull off active attacks of various types (in which the attacker can modify or forge messages to achieve some goal). One-time pads are extremely ...

6

The system described in the quoted article depends on the security of AES with random keys (not only on the theoretical unbreakability of the OTP) for at least two things: the encryption of large files, as apparent in the quotes of the question; the initial establishment of the OTP, as shown by this other quote The first step is always optical, and ...

6

No, that doesn't work. OTP is secure because knowledge of the plaintext doesn't give you any useful information about the key. This is because the bits of the key (e.g. $P_0$) are never used to encrypt anything else. If you would somehow reuse the key then leakage of the plaintext would cause leakage of $P_0$. Leakage of $P_0$ directly leaks $P_1$. I.e. ...

5

This is not a mathematical proof. A notable place it fails to be a proof is here: Pay attention to which cipher text I use, look up to match the message with the cipher-number below. $$cipher1⊕cipher3=character1⊕character3⊕IV1⊕IV2$$ (Note that the cipher BOTH use the SAME KEY, but they remain secure because of the two different IV) This line is ...

5

At least, doing the goof of reusing the OTP makes one vulnerable to disclosure of any of the key, which trivially reveals all the others. For the rest, the consequences depends heavilly on what the keys are intended for. If the keys are intended for a block cipher that is secure including under related-key attack (as AES almost is), then there is not ...

5

fkraiem's answer is correct, but more context is required, in my opinion. The one-time pad (the theoretical device) has not been broken. But real-world systems based on the one-time pad have failed in practice. Systems based on one-time pads have failed in the past because key material has been reused, either by mistake or because the sender had ran out of ...

5

In a lot of cases OTP will be completely impractical. If instead of a truly random pad you use a pseudo random pad, you will have something a lot more practical. But it is no longer OTP, and the security proofs about OTP means nothing in that case. I think this is the essence of the Bruce Schneier quote you mention. If we for a moment ignore the impractical ...

5

We know, by the encryption rule for one-time pads, where $k$ is the re-used pad: $p_1 \oplus k = c_1$ and $p_2 \oplus k = c_2$. For $\oplus$ (xor) the following arithmetic is valid: $a \oplus a = 0$ for all $a$ (everything is its own inverse), which is clear from truth tables, e.g., and $a \oplus (b \oplus c) = (a \oplus b) \oplus c$, i.e. the operation ...

4

Not as secure as a one time pad. A key concept with one time pads is that no part of them is ever reused. It is a common pitfall of people attempting to implement cryptography to assume that an obscure relationship is necessarily a secure one: it is not. You are create a chain of SHA hashes that can be observed, and potentially decoded. Therefore what you ...

4

If you perform the distribution digitally (using networks) then you have a problem. Unless you use another one time pad you lose the perfect confidentiality as the distribution itself won't deliver perfect security. But using another one time pad is pointless: you would lose exactly as many key bits as you are distributing, while you are only protecting the ...

4

I believe you need a few clarifications to answer this question yourself. The first is the one time pad (OTP). This is the only truly unbreakable system if it's used correctly. Using correctly means that for every symbol of the message there is exactly one truly random symbol in the key. Specifically, this means that there is no chosen symbol of the key ...

4

This cipher is called a one-time pad. It is unbreakable ("perfect secrecy") assuming that: The pad (the collection of random bits) really is truly random The pad is never reused to encrypt other messages So, no information can be extracted from $\text{file} \oplus \text{random bits}$. The basic idea of the proof is that an attacker can test every ...

4

There is no security difference. Of course, purely random characters with entropy rate $\log M$ where $M$ is the size of the alphabet should be independently generated and used for the OTP, whatever the size $M$ of the alphabet.

3

Simply put: No. First recall that this is a mis-use of the term "One Time Pad" So lets call it a Vigenère cipher instead. You can determine this is insecure with a simple algebraic combination: $\text{attack} = cipher_1 + cipher_2 + cipher_3 + cipher_4 \\ \text{Simplify: } \\ \text{attack} = character_1 + key_1 + IV_1 + character_2 + key_2 + IV_1 + ... 3 First, the system as I understand it does not use a one-time-pad at all, but a stream cipher. The keystream is generated via a CSPRNG, and is not truly random, so it cannot be a one-time-pad. They are misrepresenting it. But, to answer your question, let's assume the system did in fact use a one-time-pad, and used it in the manner described. In this ... 3 No, because then you could calculate$z_1 \oplus z_2 = (m_1 \land m_2) \oplus (m_1 \lor m_2) = m_1 \oplus m_2$. In practice, you can only find$m_1 \oplus m_2$if both$m_1$and$m_2$are encrypted with the same OTP (i.e.,$(m_1 \oplus y_1) \oplus (m_2 \oplus y_1) = m_1 \oplus m_2$). So without any knowledge of$m_1$,$m_2$,$y_1$or$y_2$, there is no way ... 3 The proof for the perfect secrecy property of the one time pad is quite simple. It makes use of basic probabilities and it says that: $$Pr[M=m|C=c]=Pr[M=m]$$ for a probability distribution M$\{0,1\}^n$for the message space and a probability space C for the ciphertext space. Proof: $$Pr[C=c]=\sum{Pr[C=c|M=m']\cdot Pr[M=m']} =\sum{Pr[K=m'\oplus c]}\cdot ... 3 First things first: what you are describing there is not a one-time-pad! As I explained in another answer of mine: Per definition, OTP requires the “key“ to be… a truly random one-time pad value, generated and exchanged in a secure way, at least as long as the message, and only to be used once. What you describe (eg: using a key ... 3 For a scheme to be information-theoretically secure, you need that$$\Pr[M=m\mid C=c]=\Pr[M=m\mid C=c^\prime]$$for all$c,c^\prime$(that is, any ciphertext has the same probability$M=m$, so the ciphertext doesn't change the probability$M=m$). Let's suppose we have a$c$and a$c^\prime$. Both of them have the same number of ones and zeroes, because both ... 3 Note: In this answer, I stick to a definition of the One Time Pad where the random pad is used only One Time; at least, I've the name of it as support! Otherwise, it is well known that the OTP encryption scheme consisting of XOR with a repeated key is insecure by even the weakest standard (unknown plaintext with redundancy). INDistinguishability under ... 3 No, it's not secure; after three messages, the attacker can gain information about the second and third messages. To review this in greater detail, lets look at your proposal, and what it actually exposes to the user: To start with, you have a secret$x_0$and$y_0$(I'll subscript them to distinguish the values between the iterations). To encrypt the ... 3 The One-Time Pad employs neither confusion nor diffusion, as defined by Shannon: "Two methods (other than recourse to ideal systems) suggest themselves for frustrating a statistical analysis. These we may call the methods of diffusion and confusion. In the method of diffusion the statistical structure of$M$which leads to its redundancy is “dissipated” ... 3 The security notion one usually considers for OTP is perfect secrecy, which informally means that the ciphertext does not reveal any information about the original message, regardless of the computational power of the adversary. It is already known that this requires that the key size must be equal to the plaintext size and that all keys are equiprobable. ... 3 This scheme follows the KEM/DEM approach of contructing secure asymmetric encryption schemes. However for a KEM/DEM PKCS (public key cryptosystem) to be secure it is required that both the key encapsulation mechanism (KEM) and the data encapsulation mechanism (DEM) are CPA or CCA secure for CPA or CCA of the whole scheme. Indeed the DEM looks CPA secure as ... 3 Sorry, I would only give partial points for a CCA attack on this scheme. The answer by @SEJPM is of course correct (and very informational so it's good it was posted). However, it is not the "best" answer, since this scheme can be easily broken under a chosen-plaintext attack. I will not write the full answer out (so that I can leave some work to be done for ... 3 In order to achieve very high security for privacy, would it be cryptographically secure to use one time pad ciphers in emails? OTP offers perfect secrecy, so if it's feasible to use it, it is secure. However, OTP alone offers no authentication and leaves the message malleable. If Alice sends a message Y to Bob, standing for 'yes', Mallory can guess ... 3 Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? No. (Please keep reading…) A single mathematical formula won’t cut it. That’s where cryptographic algorithms come in. There are more than a handfull of cryptographically secure ... 3$c_2 \: = \: m\oplus k_2 \: = \: m\oplus k_1 \oplus k_1 \oplus k_2 \: = \: c_1 \oplus k_1 \oplus k_2k_1 \oplus k_1 \: = \: 00000...00000$Since fixing either argument turns xor into a bijection, the distribution of$\: k_1 \oplus k_2$is uniform on non-zero strings.$\;\;\;$Thus, knowledge of$c_1$is enough to sample from$c_2$'s distribution, so ... 2 This would be insecure in most any practical setting. This is because most any message has patterns or structure that is known or guessable to the attacker. For example, perhaps many messages start with "Hello" and end with the sender's name ("Sincerely, Bob"). With this knowledge, an attacker can not only determine that part of the key to the next ... 2 The question describes a stream cipher with key$S$, using$C_S(R)$to transmit a random session key$R$, and a keystream (or pad) generated from$R\$ using a CSPRNG to encipher the message. This is not an OTP; and contrary to an OTP, it is not secure against a computationally unbounded adversary, who hypothetically, knowing a plaintext/ciphertext pair ...

Only top voted, non community-wiki answers of a minimum length are eligible