Return to Answer

Imagine a one-bit message. With one-time pad (Vernam's cipher) encryption, the attacker can't guess anything. If the ciphertext is 0, the plaintext is 0 with probability $p$ (and the plaintext is 1 with the probability $1-p$). Attacker can't learn anything. When the ciphertext is 1, attacker is in the same situation.

In this case, the attacker has done an exhaustive key search. He has found a correct plaintext during the exhaustive key search. He however does not have an idea which of all the possible plaintexts are correct. The one-time pad has thus provided unconditional secrecy in this case. (The unconditional secrecy would be lost when the key is not random enough or once the key is reused, though.)

You can even encrypt in this way a 1 terabyte message with a SHA-256 hash with one-time pad. You would need at least $8\cdot2^{40} + 256$ bits of the key for encrypting both the message and its hash. (For unconditional secrecy, it is essential to have the hash encrypted.)

Imagine a one-bit message $m$. Attacker knows that $m = 0$ with probability $p$ and $m=1$ with probability $1-p$. (In many cases, $p=0.5$.)

With one-time pad (Vernam's cipher) encryption, the attacker can't guess anything. If the ciphertext is 0, the plaintext is 0 with probability $p$ (and the plaintext is 1 with the probability $1-p$). Attacker can't learn anything. When the ciphertext is 1, attacker is in the same situation. In other words, attacker knows only the information he knew in advance.

In this case, the attacker has done an exhaustive key search. He has found a correct plaintext during the exhaustive key search. He however does not have an idea which of all the possible plaintexts are correct. The one-time pad has thus provided unconditional secrecy in this case. (The unconditional secrecy would be lost when the key is not random enough or once the key is reused, though.)

You can even encrypt in this way a 1 terabyte message with a SHA-256 hash with one-time pad. You would need at least $8\cdot2^{40} + 256$ bits of the key for encrypting both the message and its hash. (For unconditional secrecy, it is essential to have the hash encrypted.)

Imagine a one-bit message. With one-time pad (Vernam's cipher) encryption, the attacker can't guess anything. If the ciphertext is 0, the plaintext is 0 with 50% probability (and the plaintext is 1 with the same probability). Attacker can't learn anything. When the ciphertext is 1, attacker is in the same situation.

In this case, the attacker has done an exhaustive key search. He has found a correct plaintext during the exhaustive key search. He however does not have an idea which of all the possible plaintexts are correct. The one-time pad has thus provided unconditional secrecy in this case. (The unconditional secrecy would be lost when the key is not random enough or once the key is reused, though.)

You can even encrypt in this way a 1 terabyte message with a SHA-256 hash with one-time pad. You would need at least $8\cdot2^{40} + 256$ bits of the key for encrypting both the message and its hash. (For unconditional secrecy, it is essential to have the hash encrypted.)

Imagine a one-bit message. With one-time pad (Vernam's cipher) encryption, the attacker can't guess anything. If the ciphertext is 0, the plaintext is 0 with probability $p$ (and the plaintext is 1 with the probability $1-p$). Attacker can't learn anything. When the ciphertext is 1, attacker is in the same situation.

In this case, the attacker has done an exhaustive key search. He has found a correct plaintext during the exhaustive key search. He however does not have an idea which of all the possible plaintexts are correct. The one-time pad has thus provided unconditional secrecy in this case. (The unconditional secrecy would be lost when the key is not random enough or once the key is reused, though.)

You can even encrypt in this way a 1 terabyte message with a SHA-256 hash with one-time pad. You would need at least $8\cdot2^{40} + 256$ bits of the key for encrypting both the message and its hash. (For unconditional secrecy, it is essential to have the hash encrypted.)

Imagine a one-bit message. With one-time pad (Vernam's cipher) encryption, the attacker can't guess anything. If the ciphertext is 0, the plaintext is 0 with 50% probability (and the plaintext is 1 with the same probability). Attacker can't learn anything. When the ciphertext is 1, attacker is in the same situation.

Imagine a one-bit message. With one-time pad (Vernam's cipher) encryption, the attacker can't guess anything. If the ciphertext is 0, the plaintext is 0 with 50% probability (and the plaintext is 1 with the same probability). Attacker can't learn anything. When the ciphertext is 1, attacker is in the same situation.

In this case, the attacker has done an exhaustive key search. He has found a correct plaintext during the exhaustive key search. He however does not have an idea which of all the possible plaintexts are correct. The one-time pad has thus provided unconditional secrecy in this case. (The unconditional secrecy would be lost when the key is not random enough or once the key is reused, though.)

You can even encrypt in this way a 1 terabyte message with a SHA-256 hash with one-time pad. You would need at least $8\cdot2^{40} + 256$ bits of the key for encrypting both the message and its hash. (For unconditional secrecy, it is essential to have the hash encrypted.)