3
$\begingroup$

As we know, intercepted ciphertext created by a one-time pad only reveals the length of the message. That is the only information the attacker can get since this ciphertext is unbreakable without the key.

I understand that for a file 1GB in size we need a key that is 1GB long. My question is: why is the one-time pad not more widely used in encryption for communications that use a small bandwidth?

$\endgroup$
  • $\begingroup$ It's actually somewhat better than that. If all your messages are routinely padded with zeros at the end up to say 1000 characters, even the true message length is obfuscated. The error crypto pundits make regarding OPT is that it is used for encrypting whole hard disks. No. OTP's sweet spot is short important messages like encryption keys or attack orders, not porn films. There is nothing of strategic /life critical importance that takes up 1GB. 1 GB of randomness would serve you for ages. $\endgroup$ – Paul Uszak Jan 4 '17 at 15:51
  • $\begingroup$ We use stream ciphers in practice, which are conceptually just a generalization of one-time pads to pseudorandom sources. They aren't information-theoretically secure, but (we believe) they're computationally secure which is for practical purposes equivalent. In exchange, we get small, usable keys (128- or 256-bit), which are easily negotiated using the asymmetric algorithms used for virtually all crypto on the Internet (like TLS). $\endgroup$ – Stephen Touset Jan 4 '17 at 20:14
4
$\begingroup$

One time pads are used in many low bandwidth situations. However, they suffer from a fundamental problem of key distribution. It's hard to transmit 1GB of key information.

One time pads are most effective in situations where the trust communication channels are highly asymmetric. If you can hand deliver your OTP to an individual, positively confirm their identity, and then hand the pad over, then OTP can be quite effective. In times of war, where you can be physically provided your key material before you travel into the hostile area, this pattern can be very powerful. In more symmetric situations, transferring the key material securely can be just as difficult as transmitting the material itself! These symmetric situations are more common on the internet.

$\endgroup$
3
$\begingroup$

One time pads provide perfect secrecy, still there are many pratical limitations to it. Wikipedia states the following limitations for one time pad:

  • Lack of generating true random numbers. In theory, as far as I know, true randomness can only be generated using quantum computers, which are not present nowadays, atleast not for commercial use on this level. Today, we are use pseudorandom number generators for generating random numbers.
  • For One Time Pad to be total secure key must be the size of the message you want to send and the key must be used only once. This leads us to build a mechanism to communicate keys via a secure channel. If key(s) get to wrong hands then, result can be disastrous. Even if you have 100% secure channel this is not possible in many cases. It is difficult for communicating parties to know in advance who they are communicating. This is generally a case nowadays with internet.
  • One Time Pad provides no authentication, which pose a severe threat when used in real world. Go to this link for more info.

Thus even though One Time Pad perfect secrecy it has many limitations that leads us to not to choose it for communicating (for encryption and decryption).

$\endgroup$
  • $\begingroup$ In this real non-perfect world evidently no bit sequence obtained from a no matter how ingeneously built hardware could be absolutely "proved" to be a (theorectically) perfect OTP. On the other hand, if the cost (including secure transfer) of such a practically well done OTP is acceptable for a given application due to the extraordinary high security level required, I believe it may not be unreasonable to let such an OTP provide additional security to another encryption scheme which also provides integrity check and even signature. (It's one's freedom to deem that paranoid or doubly secure.) $\endgroup$ – Mok-Kong Shen Jan 5 '17 at 9:22
1
$\begingroup$

The OTP is routinely used all over the world. It's use has never really gone away, but there is now a resurgence due to quantum key distribution networks. They swap keys between devices using OTP encryption over fibre optics. The TRNGs are inside the devices.

The OTP has been routinely used all over the world. There are so many examples in the NSA crypto museum, I'll only list one. The reason that you're alive today is because Kennedy and Khrushchev reconciled their differences over the hot line which was a OTP encrypted teleprinter.

The reason I'm not writing this in German, is because courageous agents throughout Europe during WW2 spied for Allies and the Resistances using OTPs. These are both examples of low bandwidth OTP communications.

Up to a few years ago, you could tune in a short wave radio and actually listen to secret radio transmissions from many countries across the world sending OTP numbers. They're called numbers stations, and you can listen to the recorded transmissions on the internet.

I cannot continue without addressing "The one-time-pad relies on a true random generator. That's something that doesn't really exist. There are no physical random number generators that can be certified by e.g. NIST ". The reason they don't certify TRNG is probably because they're not allowed to by the US security services. This is de facto proof of the value of OTPs. NIST is irrelevant. True random numbers are not the property of the US government. Where do all the on-line gambling houses in the world get their legally certified true random numbers from? Britain has ERNIE (TRNG) which is continually tested for the British government and has paid out £100M's in prizes, yet has not been certified by NIST. I have two home brew tested and working TRNGs on my desk. And of course there are those quantum generators like Quantis Random Number Generator but they're not certified by NIST so perhaps they don't exist, even though they have passed all their tests. All it takes is an Arduino and a 24V zener diode and you can make one yourself.

OTPs have existed since the early 1900s and are now being used more and more. Can I suggest that these fact deniers look at this OTP from the NSA?

OTPs excel at low bandwidth communication as has been proved over and over and is a matter of historical record. In fact they are often better than the fancy and baffling AES stuff. Read through this forum and you will see that secure AES implementation is very difficult. Elliptic curve crypto is neigh on impossible as proven on this forum repeatedly. And they can't be verified manually as OTPs can.

The only conclusion that can be reached why the OPT is discouraged here is the one postulated in this question, which was then hidden in the meta trash can, effectively supporting the argument.

$\endgroup$
  • 1
    $\begingroup$ The reason they don't certify TRNG is probably because they're not allowed to by the US security services. – Huh? And what do you mean by "ECC is effectively impossible"? We're both using it right now in TLS. $\endgroup$ – forest Sep 2 at 4:06
-3
$\begingroup$

Because there's hardly any good One-Time Pad software available except for FinalCrypt (which is not well known) and because national security agencies would go out of (cracking core) business, so they don't want OTP as a standard.

$\endgroup$
  • 1
    $\begingroup$ I'm having some difficulty in identifying the entropy source within FinalCrypt that can generate the key material. Mea culpa. Using algorithmic means alone on a contemporary computer is certainly possible if tricky, but their website seems worryingly vague. Although, there are even senior contributors on this forum that confuse OTPs with stream ciphers. OTP material should be hanging out right up in your face... $\endgroup$ – Paul Uszak Sep 2 at 0:56
  • 1
    $\begingroup$ @PaulUszak No one on this site is confusing OTPs with stream ciphers. I assume you're talking about Squeamish Ossifrage who describes stream ciphers using the OTP model, which they do to make a point. $\endgroup$ – forest Sep 2 at 4:09

protected by Squeamish Ossifrage Sep 2 at 0:12

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.