3
$\begingroup$

I hope, as we know intercepted ciphertext created by One-time pad encryption tells only length of the message, and that is only information attacker can get since this ciphertext its unbreakable to decrypt without key. I understand that for file of 1GB size we need 1GB size key, my question is why One-time pad is not widely used in encryption for communications that use small bandwidth?

$\endgroup$
  • $\begingroup$ It's actually somewhat better than that. If all your messages are routinely padded with zeros at the end up to say 1000 characters, even the true message length is obfuscated. The error crypto pundits make regarding OPT is that it is used for encrypting whole hard disks. No. OTP's sweet spot is short important messages like encryption keys or attack orders, not porn films. There is nothing of strategic /life critical importance that takes up 1GB. 1 GB of randomness would serve you for ages. $\endgroup$ – Paul Uszak Jan 4 '17 at 15:51
  • $\begingroup$ We use stream ciphers in practice, which are conceptually just a generalization of one-time pads to pseudorandom sources. They aren't information-theoretically secure, but (we believe) they're computationally secure which is for practical purposes equivalent. In exchange, we get small, usable keys (128- or 256-bit), which are easily negotiated using the asymmetric algorithms used for virtually all crypto on the Internet (like TLS). $\endgroup$ – Stephen Touset Jan 4 '17 at 20:14
  • $\begingroup$ If you don't mind, I would like to point out that intercepted one-time-pad encrypted ciphertext, per se, does not really tell you a lot. For example, if you are collecting VHF digital in the park on a fine day, the traffic that you get may not even be a real message. It might just be there to defeat traffic analysis. It may have even been injected by someone else. It may be padded. It may be code. $\endgroup$ – Patriot Feb 3 '18 at 8:30
3
$\begingroup$

The OTP is routinely used all over the world. It's use has never really gone away, but there is now a resurgence due to quantum key distribution networks. They swap keys between devices using OTP encryption over fibre optics. The TRNGs are inside the devices.

The OTP has been routinely used all over the world. There are so many examples in the NSA crypto museum, I'll only list one. The reason that you're alive today is because Kennedy and Khrushchev reconciled their differences over the hot line which was a OTP encrypted teleprinter.

The reason I'm not writing this in German, is because courageous agents throughout Europe during WW2 spied for Allies and the Resistances using OTPs. These are both examples of low bandwidth OTP communications.

Up to a few years ago, you could tune in a short wave radio and actually listen to secret radio transmissions from many countries across the world sending OTP numbers. They're called numbers stations, and you can listen to the recorded transmissions on the internet.

I cannot continue without addressing "The one-time-pad relies on a true random generator. That's something that doesn't really exist. There are no physical random number generators that can be certified by e.g. NIST ". The reason they don't certify TRNG is probably because they're not allowed to by the US security services. This is de facto proof of the value of OTPs. NIST is irrelevant. True random numbers are not the property of the US government. Where do all the on-line gambling houses in the world get their legally certified true random numbers from? Britain has ERNIE (TRNG) which is continually tested for the British government and has paid out £100M's in prizes, yet has not been certified by NIST. I have two home brew tested and working TRNGs on my desk. And of course there are those quantum generators like Quantis Random Number Generator but they're not certified by NIST so perhaps they don't exist, even though they have passed all their tests. All it takes is an Arduino and a 24V zener diode and you can make one yourself.

OTPs have existed since the early 1900s and are now being used more and more. Can I suggest that these fact deniers look at this OTP from the NSA?

OTPs excel at low bandwidth communication as has been proved over and over and is a matter of historical record. In fact they are often better than the fancy and baffling AES stuff. Read through this forum and you will see that secure AES implementation is very difficult. Elliptic curve crypto is neigh on impossible as proven on this forum repeatedly. And they can't be verified manually as OTPs can.

The only conclusion that can be reached why the OPT is discouraged here is the one postulated in this question, which was then hidden in the meta trash can, effectively supporting the argument.

$\endgroup$
2
$\begingroup$

One time pads provide perfect secrecy, still there are many pratical limitations to it. Wikipedia states the following limitations for one time pad:

  • Lack of generating true random numbers. In theory, as far as I know, true randomness can only be generated using quantum computers, which are not present nowadays, atleast not for commercial use on this level. Today, we are use pseudorandom number generators for generating random numbers.
  • For One Time Pad to be total secure key must be the size of the message you want to send and the key must be used only once. This leads us to build a mechanism to communicate keys via a secure channel. If key(s) get to wrong hands then, result can be disastrous. Even if you have 100% secure channel this is not possible in many cases. It is difficult for communicating parties to know in advance who they are communicating. This is generally a case nowadays with internet.
  • One Time Pad provides no authentication, which pose a severe threat when used in real world. Go to this link for more info.

Thus even though One Time Pad perfect secrecy it has many limitations that leads us to not to choose it for communicating (for encryption and decryption).

$\endgroup$
  • $\begingroup$ In this real non-perfect world evidently no bit sequence obtained from a no matter how ingeneously built hardware could be absolutely "proved" to be a (theorectically) perfect OTP. On the other hand, if the cost (including secure transfer) of such a practically well done OTP is acceptable for a given application due to the extraordinary high security level required, I believe it may not be unreasonable to let such an OTP provide additional security to another encryption scheme which also provides integrity check and even signature. (It's one's freedom to deem that paranoid or doubly secure.) $\endgroup$ – Mok-Kong Shen Jan 5 '17 at 9:22
2
$\begingroup$

One time pads are used in many low bandwidth situations. However, they suffer from a fundamental problem of key distribution. It's hard to transmit 1GB of key information.

One time pads are most effective in situations where the trust communication channels are highly asymmetric. If you can hand deliver your OTP to an individual, positively confirm their identity, and then hand the pad over, then OTP can be quite effective. In times of war, where you can be physically provided your key material before you travel into the hostile area, this pattern can be very powerful. In more symmetric situations, transferring the key material securely can be just as difficult as transmitting the material itself! These symmetric situations are more common on the internet.

$\endgroup$
1
$\begingroup$

Yes, One Time Pads (OTPs) are the ideal in encryption; as stated by Ugnes, Claude Shannon (the father of information theory) long ago identified these as perfect secrecy - their shortcoming is that they cannot be used on more than one message.

OTPs are the ancestor to Multiple Use Pads (MUPs). If you are interested in OTPs, then you might want to take a look at MUPs. MUPs have creatively eliminated the shortcomings of OTPs - making them reusable and thus practical.

By removing the reliably identifiable patterns that would break OTPs if used on more than 1 message, and morphing the implementation of the MUP, MUPs provide a fast and secure means of encryption that will not be vulnerable to quantum computers.

I must disclose that I am the founder of CORAcsi, and developer of MUPs.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.