zendo data size restrictions

Question

zendo is a new mobile phone app which encrypts messages using a one-time pad:

http://techcrunch.com/2015/03/24/one-time-pads-ride-again/

users have to meet in person and exchange a key via a qr code. the one-time pad data is then initialized on both phones using this key to make a secure transfer. however, according to the article, only 0.5MB of pad data is exchanged:

The process takes a few seconds for 0.5MB of pad to be exchanged — which is enough for “thousands” of messages between the two users. More than 3,000 based on a conservative estimate of average text message length, according to Newbold. You can also exchange multiple pads to stockpile more megabytes for even more future missives. (To be clear, if users run out of pad, the app defaults to AES encryption so messages are never sent unencrypted — it just steps down to industry standard levels of security.)

Pictures can also be sent via Zendo, and those are encrypted with a single use AES 256bit key and an HMAC key (for authentication), which are then sent using One-time pad encryption, so the photos are secured via OTP without needing to use up too much of the pad to send them. The same method will be used to encrypt and send videos, audio and documents/attachments — file transfer features which will be coming in future updates to the app.

it was my understanding that a one-time pad must be as long as the plaintext being transferred, so 0.5MB of pad would enable no more than 0.5MB of plaintext to be transmitted with perfect secrecy.

however the above excerpt makes it sound like the pad can be shorter than the plaintext while still maintaining the complete security of a one-time pad:

so the photos are secured via OTP without needing to use up too much of the pad to send them

i'm just wondering if this is some cryptographic technique that i have not heard of, or if the article is wrong to imply that the cyphertext will have the same security (entropy) as the pad, for data that is longer than the 0.5MB pad (as most photos and videos are)?

---

edit

my problem was actually with the wording of the article. i was reading the above quote as:

Pictures can also be sent via Zendo, and those are encrypted with a single use AES 256bit key and an HMAC key (for authentication), [the pictures] are then sent using One-time pad encryption, so the photos are secured via OTP without needing to use up too much of the pad to send them.

but actually i think the article means to say:

Pictures can also be sent via Zendo, and those are encrypted with a single use AES 256bit key and an HMAC key (for authentication), [the aes key and hmac key, but not the pictures] are then sent using One-time pad encryption, so the photos are secured via OTP without needing to use up too much of the pad to send them.

and this makes a lot more sense.

sorry this turned out to be more of a reading comprehension question than a cryptography question in the end :p

i don't want to add another question now as that would be unfair to those who have already given answers addressing my first misunderstanding-question. thanks.

Answer 1

The system described in the quoted article depends on the security of AES with random keys (not only on the theoretical unbreakability of the OTP) for at least two things:

• the encryption of large files, as apparent in the quotes of the question;
• the initial establishment of the OTP, as shown by this other quote
  

  The first step is always optical, and that is an exchange of an AES 256bit key, plus an authentication key, and so those are the keys to encrypt the One-time pad as it’s being transferred wirelessly via Multipeer [or Wi-Fi Direct]… with a symmetrical AES key that was exchanged optically.

Claims that a practical system base its security directly on the OTP are typically misleading, on purpose as a marketing point or by incompetence, often both.

---

Addition per comment: the technique used for photos seems to be using 256 bits from the pad as an AES key enciphering the photo. This is not as secure as the OTP from an information-theoretic standpoint, yet this is believed practically secure when done properly.

Answer 2

First, the system as I understand it does not use a one-time-pad at all, but a stream cipher. The keystream is generated via a CSPRNG, and is not truly random, so it cannot be a one-time-pad. They are misrepresenting it.

But, to answer your question, let's assume the system did in fact use a one-time-pad, and used it in the manner described.

In this case, the photo is not protected by the one time pad, but by the cipher system used to encrypt it, in this case, AES. The key exchange is the only part that uses the one-time-page, and so the key is the only plaintext that gets the benefit of the secrecy of the one-time-pad. The photo itself is only as secure as AES.

To better illustrate this, imagine that the encryption system used was not AES, but a custom scheme that use a key of a single bit, and if the key bit were 0, it would flip every other bit of the plaintext, and if the key bit were 1, it would flip every third bit.

Applied to this system, the security of the OTP is exactly the same as in the system they're actually using. The key is still perfectly secret, as sent. Since it is protected with the OTP, there is no way for you to know if the key is a 0 or a 1. Perfect secrecy tells us this. However, the ciphertext is still virtually unprotected, because the cipher being used to "encrypt" it is comically weak.

So, while the key gets the benefits of the OTP in our fictional system, the photo or video does not. It is protected by AES, and nothing else.

Answer 3

To answer the question of whether they would need some special technique to OTP encrypt a message longer than their key:

No, to realize their claim of more than 3000 text messages they can use standard OTP. You are correct that with 0.5MB OTP key you can encrypt at most 0.5MB of data. 0.5MB is 500.000Bytes meaning as many characters can be encrypted (assuming a byte per char). A standard sms text message is max 160 characters as I recall. So that gives enough OTP key to encrypt at least 3125 text messages, which seems to be what they are claiming.

Now, if this is a good idea, or if there could be other weakness in the designed solution is an other question, which the other answers deal with.