There are many questions here; I am not answering the question in the title, but rather addressing the final questions in the body.
One-time pad encryption nevertheless has a bright future. It is in fact the only crypto algorithm that has any future. Once that computational power and codebreaking technology has surpassed the capabilities of cryptologists and the limitations of mathematics to make strong encryption, there will no longer be any crypto algorithm that survives the evolution of cryptology, unless it meets the standards of information-theoretical perfect security. Just as classical pencil-and-paper ciphers were rendered useless with the advent of the computer, so will current computer based crypto algorithms become victim to the evolution of technology, and that moment might creep on us much faster than we expect. Only one-time pad encryption, the only information theoretically secure encryption, will survive that evolution.
The linked article describes OTPs at great length. It goes on to quickly make casual claims about how doomed all other cryptographic algorithms are, without providing any kind of citation or real argument for why this will be the case. There is no reference to even a weak argument such as "but maybe P=NP". They make vague references to increasing computational power and improved cryptanalytic techniques, so I guess that is what we will have to cover.
Computational Power
This demonstrates a lack of understanding of how the cost of cracking a key actually scales. Claiming that advances in computational power alone will ever threaten the security of, for example, AES-256, is evidence in support of this. No amount of computing power will ever brute force an AES-256 key. It is not a possibility even from a theoretical point of view, let alone a practical one.
Additional misunderstandings are present in the paragraph immediately preceding that one:
Another disadvantage is that one-time encryption doesn't provide message authentication and integrity.
Ok good, this is true and at least the author recognizes this much.
Of course, you know that the sender is authentic, because he has the appropriate key and only he can produce a decipherable ciphertext ...
This is silly. Anyone can simply craft any set of bits they want and submit it as a "ciphertext", and the receiving party has no way of verifying that the message actually came from anyone in particular (indeed, they could not accurately tell the difference between a ciphertext intended for them and a pile of random bits)
Continuing further into that same paragraph, we see the author advocate MAC-then-encrypt (edit: Actually, it's arguably not even MAC-then-encrypt as the hash is not even keyed), which runs contrary to standard best practices
A solution is to use a hash algorithm on the plaintext and send the hash output value, encrypted along with the message, to the recipient (a hash value is a unique fixed-length value, derived from a message). Only the person who has the proper one-time pad is able to correctly encrypt the message and corresponding hash. An adversary cannot predict the effect of his manipulations on the plaintext, nor on the hash value. Upon reception, the message is deciphered and its content checked by comparing the received hash value with a hash that is created from the received message. Unfortunately, a computer is required to calculate the hash value, making this method of authentication impossible for a purely manual encryption.
Interestingly enough, regular old hash functions appear to be good enough for our information-theoretic security lover, despite the fact that information-theoretically secure MACs exist.
But what about cryptanalysis?
Cryptanalytic attacks may exist that can recover a key in less time then brute force. This does not imply that:
- The space requirements of such attacks is practical
- The time requirements of such attacks is practical (> 2 ** 100 == impractical)
- The conditions required for the attack to function may not be realistic
- For example/before anyone comments with "But related key attacks on AES-256!", consider the context and costs of that attack:
- There is a key owner; the key is KA
and the attackers tries to guess it.
- The key owner can somehow be persuaded to compute three other keys KB
, KC and KD, from KA, using a specific derivation algorithm (KB is equal to KA XORed with a constant that the attacker chooses; KC and KD
use a more complex but equally deterministic derivation algorithm).
- Then, the attacker can make the key owner encrypt and decrypt arbitrary blocks -- that the attacker chooses -- with the keys KA
, KB, KC and KD.
- The key owner will accept to process up to $2^{99.5}$ blocks (that's 16-byte blocks, hence a grand total of about 14 thousands of billions of billions of gigabytes).
- Finally, the attacker has access to some storage space of about one million of billions of gigabytes.
Did you see the part where the adversary can encrypt and decrypt 14 thousands of billions of billions of gigabytes under four different keys of their choosing? What exactly is your cipher protecting, in this scenario? Why does the adversary even need your key if they have access to a decryption oracle? Is this really a reasonable and practical scenario to be in? Would you really base your decision on which algorithm to use based off of an attack with these kind of requirements?
The point is that just using "the bottom line" where the author(s) consolidate all of their attack into a single measurement of time as the only gauge for security is too narrow of a perspective. Is an algorithm that is broken in time 2 ** 115 really less secure then an algorithm that requires time 2 ** 128 to break? Obviously in theory the correct answer to the question is "yes", but in practice both such attacks would take too long to execute and hence both would offer equivalent security as neither attack would ever be performed (we will ignore the argument that the hypothetical attacks could be improved).
Am I misunderstanding something here that would allow widespread QKD and OTP to become practical for a large distributed consumer network? Or is the conclusion this article came to questionable as I suspected?
There are reasons to believe that the conclusion of the article is questionable. The author of the article basically claims that widespread QKD+OTP is needed, but does not appear to offer any constructive advice as to how to build such a future, nor any supporting evidence for why all of the rest of cryptography is apparently doomed.
Amidst all of the praise of the OTP, they completely neglect to mention how the algorithms that are used in practice (i.e. AES/ChaCha) succeed at providing security to the entire world on a regular basis, while the OTP in all of it's theoretically perfect glory has been broken in practice on multiple occasions.
The OTP and quantum cryptography are basically the opposite of practical cryptography. The more complicated the communication system is, the more vulnerable it will be to attack.
Adversaries will not target the strongest parts of the equation; Supposing you really did utilize QKD and OTP to secure your messages, they will simply wait for you to receive the messages then extract the information from you personally.
Either that or they will target/exploit some aspect of the implementation, because there is a difference between a theoretically secure algorithm and a secure implementation of that algorithm.
