I hope, as we know intercepted ciphertext created by One-time pad encryption tells only length of the message, and that is only information attacker can get since this ciphertext its unbreakable to decrypt without key. I understand that for file of 1GB size we need 1GB size key, my question is why One-time pad is not widely used in encryption for communications that use small bandwidth?
The OTP is routinely used all over the world. It's use has never really gone away, but there is now a resurgence due to quantum key distribution networks. They swap keys between devices using OTP encryption over fibre optics. The TRNGs are inside the devices.
The OTP has been routinely used all over the world. There are so many examples in the NSA crypto museum, I'll only list one. The reason that you're alive today is because Kennedy and Khrushchev reconciled their differences over the hot line which was a OTP encrypted teleprinter.
The reason I'm not writing this in German, is because courageous agents throughout Europe during WW2 spied for Allies and the Resistances using OTPs. These are both examples of low bandwidth OTP communications.
Up to a few years ago, you could tune in a short wave radio and actually listen to secret radio transmissions from many countries across the world sending OTP numbers. They're called numbers stations, and you can listen to the recorded transmissions on the internet.
I cannot continue without addressing "The one-time-pad relies on a true random generator. That's something that doesn't really exist. There are no physical random number generators that can be certified by e.g. NIST ". The reason they don't certify TRNG is probably because they're not allowed to by the US security services. This is de facto proof of the value of OTPs. NIST is irrelevant. True random numbers are not the property of the US government. Where do all the on-line gambling houses in the world get their legally certified true random numbers from? Britain has ERNIE (TRNG) which is continually tested for the British government and has paid out £100M's in prizes, yet has not been certified by NIST. I have two home brew tested and working TRNGs on my desk. And of course there are those quantum generators like Quantis Random Number Generator but they're not certified by NIST so perhaps they don't exist, even though they have passed all their tests. All it takes is an Arduino and a 24V zener diode and you can make one yourself.
OTPs have existed since the early 1900s and are now being used more and more. Can I suggest that these fact deniers look at this OTP from the NSA?
OTPs excel at low bandwidth communication as has been proved over and over and is a matter of historical record. In fact they are often better than the fancy and baffling AES stuff. Read through this forum and you will see that secure AES implementation is very difficult. Elliptic curve crypto is neigh on impossible as proven on this forum repeatedly. And they can't be verified manually as OTPs can.
The only conclusion that can be reached why the OPT is discouraged here is the one postulated in this question, which was then hidden in the meta trash can, effectively supporting the argument.
One time pads provide perfect secrecy, still there are many pratical limitations to it. Wikipedia states the following limitations for one time pad:
- Lack of generating true random numbers. In theory, as far as I know, true randomness can only be generated using quantum computers, which are not present nowadays, atleast not for commercial use on this level. Today, we are use pseudorandom number generators for generating random numbers.
- For One Time Pad to be total secure key must be the size of the message you want to send and the key must be used only once. This leads us to build a mechanism to communicate keys via a secure channel. If key(s) get to wrong hands then, result can be disastrous. Even if you have 100% secure channel this is not possible in many cases. It is difficult for communicating parties to know in advance who they are communicating. This is generally a case nowadays with internet.
- One Time Pad provides no authentication, which pose a severe threat when used in real world. Go to this link for more info.
Thus even though One Time Pad perfect secrecy it has many limitations that leads us to not to choose it for communicating (for encryption and decryption).
One time pads are used in many low bandwidth situations. However, they suffer from a fundamental problem of key distribution. It's hard to transmit 1GB of key information.
One time pads are most effective in situations where the trust communication channels are highly asymmetric. If you can hand deliver your OTP to an individual, positively confirm their identity, and then hand the pad over, then OTP can be quite effective. In times of war, where you can be physically provided your key material before you travel into the hostile area, this pattern can be very powerful. In more symmetric situations, transferring the key material securely can be just as difficult as transmitting the material itself! These symmetric situations are more common on the internet.
Yes, One Time Pads (OTPs) are the ideal in encryption; as stated by Ugnes, Claude Shannon (the father of information theory) long ago identified these as perfect secrecy - their shortcoming is that they cannot be used on more than one message.
OTPs are the ancestor to Multiple Use Pads (MUPs). If you are interested in OTPs, then you might want to take a look at MUPs. MUPs have creatively eliminated the shortcomings of OTPs - making them reusable and thus practical.
By removing the reliably identifiable patterns that would break OTPs if used on more than 1 message, and morphing the implementation of the MUP, MUPs provide a fast and secure means of encryption that will not be vulnerable to quantum computers.
I must disclose that I am the founder of CORAcsi, and developer of MUPs.