13
$\begingroup$

The symmetric cryptosystem one-time pad (OTP) seems to be very beautiful since it is perfectly secret according to Shannon. Many books, however, point out the main drawback: one must create a secret key the same length as the plaintext. For this reason, the concept of perfect secrecy has these days been abandoned, and we prefer other cryptosystems.

Now, for example, suppose I want to encode my text message with the ASCII scheme, and moreover suppose that this plaintext is 10 gigabytes long, therefore (using an OTP) the key must be the same length, 10 gigabytes. I think, however, this is a ''sustainable price'' because I'm sure that the ciphertext can't be attacked.

Practically, I don't understand why having such long keys with an OTP is a big disadvantage if we reach "the dream"-- namely, perfect secrecy. Nowadays the storage of information is very easy, so what is the real problem? I can, for example, share the "long key" in person.

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ Physical meetings in a globalised world are often not that practical and as poncho says we have cheaper and far more practical alternatives at the cost of computational privacy. But to be honest, we rarely have that important messages that need to stay confidential until our sun ends up in a beautiful supernova :) $\endgroup$
    – DrLecter
    Commented Apr 17, 2014 at 19:48

3 Answers 3

Reset to default
20
$\begingroup$

Actually, the problem with OTP isn't the storage of the pad (although secure erasure of the parts of the pad you used is trickier than it looks), and it isn't the pad generation (although, again, that's trickier than it looks), but the secure transport.

After all, it's not enough for you (Alice) to have the secure pad, you also have to give a copy to the guy (Bob) you're sending the message to, and you need to send it in a way that's secure.

That's the real reason OTP's aren't used that often; OTP's would require meeting with the other side directly, or alternatively using a trusted courier; we rarely want to put up with the expense with either, especially since there are cheaper alternatives available.

Improve this answer
$\endgroup$
6
  • 2
    $\begingroup$ Since the pad is at least the same size as the message, then if you have a secure channel to transmit the pad, you can often use the same channel to transmit the message itself, and not bother with the pad at all. OTPs are sometimes used when the pad transmission is simple (hand a memory stick to your spy) but the later message transmission is difficult (transmit the secret enemy plans). $\endgroup$
    – rossum
    Commented Apr 19, 2014 at 10:48
  • 5
    $\begingroup$ @rossum: What you say is true; however I didn't raise that issue because the secure channel may have significant latency (e.g. require a physical meeting), and you cannot tolerate that latency when sending the actual message; hence OTP may be useful that way. That said, conventional crypto also does the same thing, and generally in a more useful way. $\endgroup$
    – poncho
    Commented Apr 21, 2014 at 22:55
  • $\begingroup$ There are many situations in which one may temporarily have access to a secure means of conveying information (e.g. the other guy may be in the room at the moment) but might not have at that time the information to be sent; later, one might acquire the information to be sent but no longer have access to a secure means of conveyance. Other means of cryptography are more convenient than OTP while being essentially as secure; OTP has insufficient advantage to justify the reduced convenience, but would be practical if other means of security were available. $\endgroup$
    – supercat
    Commented Nov 13, 2014 at 23:53
  • 1
    $\begingroup$ Quantum Key Distribution is a candidate for information theoretic secure key exchange, which solves the problem mentioned above. $\endgroup$
    – mti
    Commented Jan 31, 2018 at 12:33
  • 1
    $\begingroup$ @mti: QKD isn't pedantically information theoretic, but besides that, it has a number of practical issues which make it less attractive $\endgroup$
    – poncho
    Commented Jan 31, 2018 at 13:00
2
$\begingroup$

There are too many pitfalls preventing effective usage of the one-time pad electronically, but they were used extensively during several real-life conflicts, especially during the Cold War.

Firstly, for the one-time pad to be truly secure, the key must be at least as long as the message. If you have a secure channel you can rely on to transmit the key, you may as well skip the whole OTP process and just directly use that channel.

Secondly, generation is tricky. If the attacker is able to determine the algorithm and parameters you used to generate the key, they can determine the entire key, giving them the ability to crack your message. A normal PRNG won't work. For maximum security, you'd need to rely on some natural process (dice, atmospheric noise, radioactivity, etc.)

One-time pads sound amazing, but are very hard to organize in practice.

Improve this answer
$\endgroup$
2
  • 2
    $\begingroup$ Well, OTP used during the cold war between the Russian embassy and Moscow. They carry the OPT key with a suitcase and used whenever they needed. When the key finished the get new OPT key. Once they had to use twice that is what we call Two-time pad. So, first paragraph is not exactly true. With OTP you want the perfect secrecy, so time maybe not really a problem to use a coin toss. $\endgroup$
    – kelalaka
    Commented Dec 30, 2018 at 22:16
  • 1
    $\begingroup$ OTP to transfer physical messages and OTP on the Internet are quite different. OTP is much more feasible in real life, albeit still quite challenging. I've edited my answer accordingly, anyhow. $\endgroup$
    – adrian
    Commented Dec 30, 2018 at 22:35
-2
$\begingroup$

A stream cypher uses a password to create a unique key of same length as the plaintext, so it can be thought of as like a one-time-pad.

Some problems are: 1. ensuring that a particular key is never re-used, 2. ensuring that there are no patterns in the generated keys which make it possible to guess or predict.

These problems were part of the downfall of the RC4 cypher.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ This is not about the question's problem. The question clearly A) considers a random pad moved in person from source to destination, rather than a keystream generated from key and IV by some generator; B) aims at perfect secrecy (resisting an arbitrarily powerful adversary), which a stream cipher does not. $\endgroup$
    – fgrieu ♦
    Commented Jan 31, 2018 at 10:15
  • 2
    $\begingroup$ You're misunderstanding the nature of the one time pad and what it uses for a key. It's not a key in the typical sense, which is then expanded via another algorithm. OTP key material has to be derived (extracted) from physical processes and events like dice, random key presses or the interaction of laser photons with vacuum energy. You can't use just an algorithm to generate the key. See the OTP tag (crypto.stackexchange.com/questions/tagged/one-time-pad) for more... $\endgroup$
    – Paul Uszak
    Commented Jan 31, 2018 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.