# Tag Info

0

No there isn't. First, OTP is private-key encryption scheme. Second, Asymmetric key is public-key encryption and No public-key encryption scheme can ever be perfectly secret. This is because the public-key (used for encryption) is available to everyone and is related to the secret-key in some way. Thus, a certain negligible amount of information is leaked. ...

3

Note: In this answer, I stick to a definition of the One Time Pad where the random pad is used only One Time; at least, I've the name of it as support! Otherwise, it is well known that the OTP encryption scheme consisting of XOR with a repeated key is insecure by even the weakest standard (unknown plaintext with redundancy). INDistinguishability under ...

0

Ciphertext indistinguishability under CPA is equivalent to semantic security. Semantic security is the computational complexity analogue to Shannon's concept of perfect secrecy. OTP is perfectly secure, therefor is CPA secure. Under CPA, the adversary will be presented with a ciphertext corresponding to a plaintext queried (the adversary chose the ...

1

XORing a key and message is called a one time pad. It is perfectly secure, providing confidentiality, when used correctly. That last part is the hard part, along with finding a situation in which you only need confidentiality.

0

This cannot be used to compromise $P_0$. Suppose that, instead of generating $C_0$ and $C_1$ as $R_0\oplus R_1$ and $R_2\oplus R_1$, the attacker instead picked $C_0$ and $C_1$ at random from the set of bit strings the length of $C_2$. This situation is indistinguishable from yours; in both cases, $R_0$ and $R_2$ are independent and follow a uniform ...

0

With a OTP you need at least as much key material as you have plaintext. See Thomas' answer. That means you need a way to distribute as much key material as you have plaintext, securely. If you can do that, you can just distribute the plaintext over the same channel, and dispense with the OTP. The one situation where OTPs make sense is in time-delayed ...

2

You need to understand that any variation on the OTP would ultimately be equivalent to the OTP security-wise, since it is unconditionally "secure" (the ciphertext leaks zero information about the plaintext or the key), and so you'd just making it harder to compute for now reason. So, sure, you can use the OTP, or some variant thereof, on 128-bit messages ...

5

At least, doing the goof of reusing the OTP makes one vulnerable to disclosure of any of the key, which trivially reveals all the others. For the rest, the consequences depends heavilly on what the keys are intended for. If the keys are intended for a block cipher that is secure including under related-key attack (as AES almost is), then there is not ...

2

Let's just consider keys of bitlength 1, it works like that for any length. We have $k_1$ and $k_2$, the 2 random keys. And we have $k_3$, the OTP key. And then we give $x_1 = k_1 \oplus k_3$ and $x_2 = k_2 \oplus k_3$ to the attacker How can you attack the OTP? You can't. However, you don't need it. Because $x_1$ and $x_2$ quite obviously reveal a lot ...

3

For a scheme to be information-theoretically secure, you need that $$\Pr[M=m\mid C=c]=\Pr[M=m\mid C=c^\prime]$$ for all $c,c^\prime$ (that is, any ciphertext has the same probability $M=m$, so the ciphertext doesn't change the probability $M=m$). Let's suppose we have a $c$ and a $c^\prime$. Both of them have the same number of ones and zeroes, because both ...

4

If you perform the distribution digitally (using networks) then you have a problem. Unless you use another one time pad you lose the perfect confidentiality as the distribution itself won't deliver perfect security. But using another one time pad is pointless: you would lose exactly as many key bits as you are distributing, while you are only protecting the ...

Top 50 recent answers are included