The keys used in an One Time Pad are required to be randomly generated from a keyspace $\mathcal{K}$, we require 256 bit random keys, i.e. $\mathcal{K}=\{0,1\}^{256}.$ Suppose we randomly select an integer $i \in I$ and compute its 256 bit message digest ($d$) through the $\operatorname{SHA-256}$ hash function. Now, can the digest $d$ be considered as a randomly generated key for the OTP scheme?

  • 2
    $\begingroup$ This way you're running SHA-256 in CTR-Mode, which is inefficient (because SHA-256 is slow compared to AES) but is secure. And BTW: This isn't called "OTP", but "stream cipher" because your key isn't perfectly random. $\endgroup$
    – SEJPM
    May 14, 2016 at 14:08

1 Answer 1


Your first sentence is entirely wrong. A OTP is a theoretical construct that requires a fully random key (at least) the size of the plaintext. Limiting the amount of random bits to 256 will by definition not be an OTP - at least not for constructions that accept a plaintext larger than 256 bits.

The same idea is that if you use a key called $i$ which is smaller than 256 for an OTP of 256 bit. The best you can hope for is to create a stream cipher, e.g. using CTR mode as SEJPM suggests. Stream ciphers are however not perfectly secure; the key may be brute forced and the plaintext exposed.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.