Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
As we know, intercepted ciphertext created by a one-time pad only reveals the length of the message. That is the only information the attacker can get since this ciphertext is unbreakable without the key.
I understand that for a file 1GB in size we need a key that is 1GB long. My question is: why is the one-time pad not more widely used in encryption for communications that use a small bandwidth?
One time pads provide perfect secrecy, still there are many pratical limitations to it. Wikipedia states the following limitations for one time pad:
Thus even though One Time Pad perfect secrecy it has many limitations that leads us to not to choose it for communicating (for encryption and decryption).
One time pads are used in many low bandwidth situations. However, they suffer from a fundamental problem of key distribution. It's hard to transmit 1GB of key information.
One time pads are most effective in situations where the trust communication channels are highly asymmetric. If you can hand deliver your OTP to an individual, positively confirm their identity, and then hand the pad over, then OTP can be quite effective. In times of war, where you can be physically provided your key material before you travel into the hostile area, this pattern can be very powerful. In more symmetric situations, transferring the key material securely can be just as difficult as transmitting the material itself! These symmetric situations are more common on the internet.
The OTP is routinely used all over the world. It's use has never really gone away, but there is now a resurgence due to quantum key distribution networks. They swap keys between devices using OTP encryption over fibre optics. The TRNGs are inside the devices.
The OTP has been routinely used all over the world. There are so many examples in the NSA crypto museum, I'll only list one. The reason that you're alive today is because Kennedy and Khrushchev reconciled their differences over the hot line which was a OTP encrypted teleprinter.
The reason I'm not writing this in German, is because courageous agents throughout Europe during WW2 spied for Allies and the Resistances using OTPs. These are both examples of low bandwidth OTP communications.
Up to a few years ago, you could tune in a short wave radio and actually listen to secret radio transmissions from many countries across the world sending OTP numbers. They're called numbers stations, and you can listen to the recorded transmissions on the internet.
I cannot continue without addressing "The one-time-pad relies on a true random generator. That's something that doesn't really exist. There are no physical random number generators that can be certified by e.g. NIST ". The reason they don't certify TRNG is probably because they're not allowed to by the US security services. This is de facto proof of the value of OTPs. NIST is irrelevant. True random numbers are not the property of the US government. Where do all the on-line gambling houses in the world get their legally certified true random numbers from? Britain has ERNIE (TRNG) which is continually tested for the British government and has paid out £100M's in prizes, yet has not been certified by NIST. I have two home brew tested and working TRNGs on my desk. And of course there are those quantum generators like Quantis Random Number Generator but they're not certified by NIST so perhaps they don't exist, even though they have passed all their tests. All it takes is an Arduino and a 24V zener diode and you can make one yourself.
OTPs have existed since the early 1900s and are now being used more and more. Can I suggest that these fact deniers look at this OTP from the NSA?
OTPs excel at low bandwidth communication as has been proved over and over and is a matter of historical record. In fact they are often better than the fancy and baffling AES stuff. Read through this forum and you will see that secure AES implementation is very difficult. Elliptic curve crypto is neigh on impossible as proven on this forum repeatedly. And they can't be verified manually as OTPs can.
The only conclusion that can be reached why the OPT is discouraged here is the one postulated in this question, which was then hidden in the meta trash can, effectively supporting the argument.
Because there's hardly any good One-Time Pad software available except for FinalCrypt (which is not well known) and because national security agencies would go out of (cracking core) business, so they don't want OTP as a standard.
