Hot answers tagged

19

Modern security has moved beyond looking just at passive attacks (in which the attacker is just a passive eavesdropper seeking to learn what was said); attackers are generally considered to be able and willing to pull off active attacks of various types (in which the attacker can modify or forge messages to achieve some goal). One-time pads are extremely ...


8

You've actually been trapped by the mindset, that OTP will hide all information about the underlying plaintext. This is not true as you have observed. The definition of perfect secrecy, given in Introduction to Modern Cryptography by Katz-Lindell reads like this: Definition 2.3 An encryption scheme $(\text{Gen, Enc, Dec})$ with message space $\mathcal ...


6

The system described in the quoted article depends on the security of AES with random keys (not only on the theoretical unbreakability of the OTP) for at least two things: the encryption of large files, as apparent in the quotes of the question; the initial establishment of the OTP, as shown by this other quote The first step is always optical, and ...


6

No, that doesn't work. OTP is secure because knowledge of the plaintext doesn't give you any useful information about the key. This is because the bits of the key (e.g. $P_0$) are never used to encrypt anything else. If you would somehow reuse the key then leakage of the plaintext would cause leakage of $P_0$. Leakage of $P_0$ directly leaks $P_1$. I.e. ...


5

At least, doing the goof of reusing the OTP makes one vulnerable to disclosure of any of the key, which trivially reveals all the others. For the rest, the consequences depends heavilly on what the keys are intended for. If the keys are intended for a block cipher that is secure including under related-key attack (as AES almost is), then there is not ...


5

This is not a mathematical proof. A notable place it fails to be a proof is here: Pay attention to which cipher text I use, look up to match the message with the cipher-number below. $$ cipher1⊕cipher3=character1⊕character3⊕IV1⊕IV2$$ (Note that the cipher BOTH use the SAME KEY, but they remain secure because of the two different IV) This line is ...


5

fkraiem's answer is correct, but more context is required, in my opinion. The one-time pad (the theoretical device) has not been broken. But real-world systems based on the one-time pad have failed in practice. Systems based on one-time pads have failed in the past because key material has been reused, either by mistake or because the sender had ran out of ...


5

In a lot of cases OTP will be completely impractical. If instead of a truly random pad you use a pseudo random pad, you will have something a lot more practical. But it is no longer OTP, and the security proofs about OTP means nothing in that case. I think this is the essence of the Bruce Schneier quote you mention. If we for a moment ignore the impractical ...


5

We know, by the encryption rule for one-time pads, where $k$ is the re-used pad: $p_1 \oplus k = c_1$ and $p_2 \oplus k = c_2$. For $\oplus$ (xor) the following arithmetic is valid: $a \oplus a = 0$ for all $a$ (everything is its own inverse), which is clear from truth tables, e.g., and $a \oplus (b \oplus c) = (a \oplus b) \oplus c$, i.e. the operation ...


4

By two-time pad I assume you mean using a one time pad key to encrypt two messages. Lets say $K$ is the key and $m_1, m_2$ are your messages. Then from the ciphertexts $c_1 = m_1 \oplus K$ and $c_2 = m_2 \oplus K$ an adversary could trivially learn information such as $x = c_1 \oplus c_2 = m_1 \oplus m_2$. Whether or not this information is "exploitable" may ...


4

Not as secure as a one time pad. A key concept with one time pads is that no part of them is ever reused. It is a common pitfall of people attempting to implement cryptography to assume that an obscure relationship is necessarily a secure one: it is not. You are create a chain of SHA hashes that can be observed, and potentially decoded. Therefore what you ...


4

If you perform the distribution digitally (using networks) then you have a problem. Unless you use another one time pad you lose the perfect confidentiality as the distribution itself won't deliver perfect security. But using another one time pad is pointless: you would lose exactly as many key bits as you are distributing, while you are only protecting the ...


4

Note: In this answer, I stick to a definition of the One Time Pad where the random pad is used only One Time; at least, I've the name of it as support! Otherwise, it is well known that the OTP encryption scheme consisting of XOR with a repeated key is insecure by even the weakest standard (unknown plaintext with redundancy). INDistinguishability under ...


4

I believe you need a few clarifications to answer this question yourself. The first is the one time pad (OTP). This is the only truly unbreakable system if it's used correctly. Using correctly means that for every symbol of the message there is exactly one truly random symbol in the key. Specifically, this means that there is no chosen symbol of the key ...


4

This cipher is called a one-time pad. It is unbreakable ("perfect secrecy") assuming that: The pad (the collection of random bits) really is truly random The pad is never reused to encrypt other messages So, no information can be extracted from $\text{file} \oplus \text{random bits}$. The basic idea of the proof is that an attacker can test every ...


4

There is no security difference. Of course, purely random characters with entropy rate $\log M$ where $M$ is the size of the alphabet should be independently generated and used for the OTP, whatever the size $M$ of the alphabet.


4

What you propose is equivalent to trying to do cryptanalysis without any cipher text or other material. Equivalently, you could just take the small plaintext seed that you know, and nothing else, and run it through a probabilistic language model to predict the most likely message. (e.g., a Markov chain text generator). Obviously, it doesn't get you very ...


4

There is no security difference; there are a handful of practical ones: With xor, you can have the same code to do encryption and decryption With xor, you don't have to pick a 'word size'; a larger CPU can handle 4 or 8 bytes at a time, while a microcontroller can handle 1 byte at a time, without changing the ciphertext With xor, you don't have to worry ...


3

Simply put: No. First recall that this is a mis-use of the term "One Time Pad" So lets call it a Vigenère cipher instead. You can determine this is insecure with a simple algebraic combination: $ \text{attack} = cipher_1 + cipher_2 + cipher_3 + cipher_4 \\ \text{Simplify: } \\ \text{attack} = character_1 + key_1 + IV_1 + character_2 + key_2 + IV_1 + ...


3

First, the system as I understand it does not use a one-time-pad at all, but a stream cipher. The keystream is generated via a CSPRNG, and is not truly random, so it cannot be a one-time-pad. They are misrepresenting it. But, to answer your question, let's assume the system did in fact use a one-time-pad, and used it in the manner described. In this ...


3

For a scheme to be information-theoretically secure, you need that $$\Pr[M=m\mid C=c]=\Pr[M=m\mid C=c^\prime]$$ for all $c,c^\prime$ (that is, any ciphertext has the same probability $M=m$, so the ciphertext doesn't change the probability $M=m$). Let's suppose we have a $c$ and a $c^\prime$. Both of them have the same number of ones and zeroes, because both ...


3

First things first: what you are describing there is not a one-time-pad! As I explained in another answer of mine: Per definition, OTP requires the “key“ to be… a truly random one-time pad value, generated and exchanged in a secure way, at least as long as the message, and only to be used once. What you describe (eg: using a key ...


3

No, it's not secure; after three messages, the attacker can gain information about the second and third messages. To review this in greater detail, lets look at your proposal, and what it actually exposes to the user: To start with, you have a secret $x_0$ and $y_0$ (I'll subscript them to distinguish the values between the iterations). To encrypt the ...


3

The One-Time Pad employs neither confusion nor diffusion, as defined by Shannon: "Two methods (other than recourse to ideal systems) suggest themselves for frustrating a statistical analysis. These we may call the methods of diffusion and confusion. In the method of diffusion the statistical structure of $M$ which leads to its redundancy is “dissipated” ...


3

The security notion one usually considers for OTP is perfect secrecy, which informally means that the ciphertext does not reveal any information about the original message, regardless of the computational power of the adversary. It is already known that this requires that the key size must be equal to the plaintext size and that all keys are equiprobable. ...


3

First things first: a PRNG (Pseudo Random Number Generator) can not provide a one-time pad. As a reminder: a one-time pad… has to be truly random, must be at least as long as the plaintext, is never reused in whole or in part, and is kept completely secret. Only when all four points are met, we´re talking about OTP. Your PRNG idea fails to meet those ...


3

This scheme follows the KEM/DEM approach of contructing secure asymmetric encryption schemes. However for a KEM/DEM PKCS (public key cryptosystem) to be secure it is required that both the key encapsulation mechanism (KEM) and the data encapsulation mechanism (DEM) are CPA or CCA secure for CPA or CCA of the whole scheme. Indeed the DEM looks CPA secure as ...


3

Sorry, I would only give partial points for a CCA attack on this scheme. The answer by @SEJPM is of course correct (and very informational so it's good it was posted). However, it is not the "best" answer, since this scheme can be easily broken under a chosen-plaintext attack. I will not write the full answer out (so that I can leave some work to be done for ...


3

In order to achieve very high security for privacy, would it be cryptographically secure to use one time pad ciphers in emails? OTP offers perfect secrecy, so if it's feasible to use it, it is secure. However, OTP alone offers no authentication and leaves the message malleable. If Alice sends a message Y to Bob, standing for 'yes', Mallory can guess ...


3

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? No. (Please keep reading…) A single mathematical formula won’t cut it. That’s where cryptographic algorithms come in. There are more than a handfull of cryptographically secure ...



Only top voted, non community-wiki answers of a minimum length are eligible