# Tag Info

10

Very short answer: No Quite Short answer: No, because a scheme can only be a One-Time-Pad if the entire pad is perfectly random and secret. Concise answer: It sounds like you're trying to build a stream cipher. The security of it really comes down to how much of the scheme you think can be kept secret. If I listen in to your wifi and hear you requesting a ...

9

Actually, one-time pad can be implemented on the basis of any finite group operation; with these requirements: The pad must consist of random group members; that is, each element in this pad must have equal probability of being any specific group member, and there must not be any correlation between different entries within the pad. The encrypt and the ...

7

It is quite simple and stems from the idea that flipping one bit in the ciphertext flips the corresponding bit in the plaintext. So, say the ciphertext is $1011$ and we know the plaintext is $0101$ (thus the key is $1110$). Say we want a plaintext of $0000$, we just have to change the ciphertext to $1110$ (notice where the bits have been flipped) and we ...

7

The general scheme is called Three-pass protocol and works for all commutative ciphers. It is secure for some of them, but xor (and modular addition) are insecure choices. Your scheme: A->B: $c_1 = m \oplus a$ B->A: $c_2 = c_1 \oplus b$ A->B: $c_3 = c_2 \oplus a$ B computes $m = c_3 \oplus b$ an attacker sees all of $c_1$, $c_2$ and $c_3$. So they can ...

6

In the "Telegraphic Code to Insure Privacy and Secrecy in the Transmission of Telegrams" from 1882, Frank Miller assigned a number to around 14,000 code words. Bankers would select an "irregular" series of such words and exchange them with a remote partner. Any messages would be lined up below the next unused words on the pad for encoding. When you lined up ...

6

Let's say Alice and Bob have $c$ bits of pre-shared secret key material. Alice generates $a$ bits of new key material, concatenates it to a message $M$ that is $b$ bits long, and uses $a+b$ bits of their pre-shared key material to encrypt "message||new-key". She sends this secure message to Bob, who decrypts it with the shared key. Now they both have $a$ ...

5

There are four concerns here: Pad generation Pad transmission Message privacy Message authenticity Pad generation The security of the one-time pad depends on the assumption that the pads are generated from a truly random source. This is actually quite a big ask. Suppose for a moment that you want to exchange a 4 gigabyte pad. Let's say your RNG does ...

5

What do you mean 'a one time pad with a password'? One time pads don't take passwords, they take samples of truly random data as long as the message. If what you're doing is taking the password, repeating it N times, and using that as if it were a random one-time pad, well, that can usually be broken even if you don't send a second message. If what you're ...

5

Firstly, I presume this is not something you are going to use for protecting data in any kind of real life scenario, but are only asking out of curiosity. Secondly, just to get the terminology straight and avoid confusion, what gives an OTP cryptographic scheme information theoretic security is that it meets both of the following two criteria: The key ...

5

If "this message" is the plaintext, then that doesn't actually help, since encrypting the new secret key uses up an amount of the old pad equal to the length of the new secret key, the total length of all "actual messages" will still be limited to the total length of the original one-time pad. If "this message" is the ciphertext, then an eavesdropper will ...

5

Assuming that you have not used the one-time pad bits $k_2, ..., k_{N+1}$ to encrypt another message, then the answer is no, the attacker cannot determine the message. This can be seen by using the normal proof of One Time Pad's security; the bits $k_2, ..., k_{N+1}$ are random and uncorrelated to any other bits the attacker has access to; hence the ...

4

One problem is that keyboard keys may or may not be uniform. Look at the F and J keys - they may have a little dot of plastic to identify them with your fingertips. That little dot may make them heavier or lighter than other keys, affecting how they shake up in a hat. Some keyboards, like Das Keyboard, were built with different spring actions for different ...

4

The system you describe is not a one-time pad, it is a stream cipher, and a bad one for that. A one time pad has real (truly) random bits in the XOR pad, which are never reused for two messages. "Their" cipher has a pseudorandom pad (with non-crypto PRNG), and if I understand right, even the same one for each message. Even a real random one-time-pad is ...

4

In the method you reference, I believe that the XOR details are irrelevent, given the following fact: For your method to be a one time pad, the key must be random and as long as the message. This gives the method special characteristics such as "perfect secrecy": http://en.wikipedia.org/wiki/One-time_pad#Perfect_secrecy In the method you reference, the ...

4

This is highly insecure. For instance, if you see the word guyk in the ciphertext, what could the corresponding plaintext word be? With your scheme (where each letter is enciphered by adding a number between 0..9 to it modulo 26), there are only 139 English words that could have led to it. (Those 139 possibilities are things like arse, blue, bore, both, ...

4

If your key material is properly random and at least as long as that which is to be encrypted, and indeed each key is used only once, then one-time pad is indeed applicable. As was noted: Distribution of keys will be a hard problem. OTP makes practical sense only in scenarios where keys can be distributed at some time T, then used for encrypting and ...

4

Well, for one thing, you are not using a "One Time Pad". A "One Time Pad" means, by definition, that someone generates a pad of numbers using true randomness (and not algorithmicly), and that no potential adversary has any information on what that pad may contain. Then, that pad is given to both the sender and the receiver, and then the sender uses it to ...

4

What you've described is generally called a "book cipher" or "Ottendorf cipher", where the "key" is knowing which publication is being referenced, as well as the algorithm for recovering information from it. A hundred years ago they were quite secure because not only were books fairly rare, but trying every book against an unknown cipher was very time ...

4

Actually, the problem with OTP isn't the storage of the pad (although secure erasure of the parts of the pad you used is trickier than it looks), and it isn't the pad generation (although, again, that's trickier than it looks), but the secure transport. After all, it's not enough for you (Alice) to have the secure pad, you also have to give a copy to the ...

3

The answer to this question follows directly from the answers to Should we MAC-then-encrypt or encrypt-then-MAC? and the comment thread here. In short: Your scheme is computationally secure (IND-CCA2 and INT-CTXT) assuming that HMAC is a computationally secure privacy-preserving MAC; but your scheme is wildly impractical, as fgrieu explains, so it is not ...

3

For your questions 1 and 3, you want to know how to convert mouse movements into usable random numbers. Others have made good suggestions there. If the PuTTYGen comments are to be believed, one movement could contribute as much as 2 bits of uncertainty. As you have stated that this project is for fun, this seems like a good place to do an experiment of ...

3

Part 1 There are some methods to do it. Phrack magazine Get the last four bits from x, the last four from y, concatenate them, XOR them with the last 8 bits that you get from your system timer (or from the fastest timer you have available) are you using java? you can specify mouse movements to be a source of entropy what I would do: Get your ...

3

If you just need to generate random key material, I suggest a simpler solution: use the OS support for generating entropy. On Linux, read from /dev/urandom. On Windows, use CryptGenRandom. Search to find support on other platforms. If you're doing this in Javascript, read the following: Compatibility of window.crypto.getRandomValues() Generate ...

3

Dice have been extremely well studied (having been used for gambling for, well, thousands of years). It is hard to beat them, for simplicity and bandwidth of random number generation, if you want to avoid use of computers for random number generation. Dice have three advantages. First, it's pretty fast to roll dice. Second, they are familiar; people ...

3

(The below may be a bit cryptic if you don't know Python.) The idea is not to decode the message, but to manipulate it. Since your ciphertext is C = OTPkey ^ "attack at dawn" all you need to do is to XOR the last 4 bytes of the ciphertext with the original text "dawn" and then again with "dusk", for example: C ^ "attack at dawn" ^ "attack at dusk" ...

3

You can construct a one-time MAC that has a similar properties to the OTP. Better still, it uses a fixed number of bits for each message. Here's how it works. Choose the closet prime to your message block size. Let's say you plan to process 128-bit chunks of your message. Let's say there are $L$ such blocks. The first job is to pick the first prime larger ...

2

Here since the key is used more than one time, an attack called Crib-Dragging can be used to attack the cipher text. A blog post which could give you a greater understanding on the implementation part is located at travisdazell.blogspot.in/2012/11/many-time-pad-attack-crib-drag.html: Many Time Pad Attack - Crib Drag The one time pad (OTP) is a ...

2

Each zero in m1⊕m2 indicates a matching character. These are known as coincidences. The number of coincidences can possibly indicate what language they are communicating in since different languages have a different character frequency distribution. (Random data should have coincidences 1/26 of the time if using only lowercase letters, whereas English should ...

2

The adversary $\mathcal A$ is an entity (think of a computer program) designed to participate in the experiment $\operatorname{PrivK}^{\text{eav}}_{A,\Pi}$. So the adversary produces two messages, then is given the encryption of one of them, and has to guess which one it was. Of course, you can give the adversary other "ciphertexts" too, but this wouldn't ...

Only top voted, non community-wiki answers of a minimum length are eligible