# Is the Vernam (One Time Pad) cipher useful? [duplicate]

By profession I’m a programmer. I don’t know a lot about how cryptographic algorithms are implemented, or even where I’d start, and I don’t know about cryptanalysis, but as I work in Blockchain technology, I know how to consume cryptographic algorithms. One might say I have a passing interest.

One thing that has piqued my curiosity, as it probably does many novices in cryptography is the Vernam, or One Time Pad cipher; supposedly 100% mathematically impossible to crack and incredibly simple to implement.

The problem seems to be around the keys used. Specifically:

1. Keys shouldn’t be reused
2. Key sequences shouldn’t be repeated
3. Keys need to be shared somehow

Other encryption algorithms solve (or don’t suffer from) these problems, but, if we can find a suitable, secure way to generate and share unique keys, does the Vernam cipher become useful?

Is there anything else that needs consideration in this respect?

• Jan 29, 2018 at 21:08
• ① Reason 1 & 2 are identical. The size of the keys or key streams is also an issue, of course, and the fact that you cannot distribute them without losing the perfect secrecy that they can provide. ② The Vernam cipher is useful and is actually used a lot, e.g. for key sharing algorithms. As for normal message encryption: forget it; normal (stream) ciphers are secure enough without the drawbacks. Jan 29, 2018 at 21:23
• You might want to get the OTP definition straight: Per definition, OTP requires the “key“ to be… (1) a truly random one-time pad value, (2) generated and exchanged in a secure way. (3) at least as long as the message, and (4) only to be used once. Jan 30, 2018 at 0:32
• Possible duplicate of One time pad: why is it useless in practice? (which practically asks the same, just wording it differently.) Jan 30, 2018 at 0:41

As you know, if a thing is useful or not depends upon context. If you are hungry, will a 4096-bit RSA key with a CAMELLIA256 subkey be useful? Not really, except perhaps as food for thought.

One-time pads are being used at this very moment by serious and perhaps dangerous people all over the world. OTPs work. Ciphertext encrypted with a one-time pad can be heard on HF radio all the time. Is it useful? Certainly. The question is: "for whom?"

Why are one-time-pads useful? You don't have carry around a lot of equipment. Paper does not leave an electronic trail. Paper burns. Little pads are easy to hide. It's hard to get a kleptotrojan into a pencil. Paper is cheap. Vernam cipher is the perfect cipher if the key is truly random, the key was protected, and the key is as long as the message. When your equipment stops working you can pull out the little book and figure out a way to deliver your message--and its content will remain private. You can actually see the key destroyed. When you destroy it, it's really gone. Everything about using a one-time-pad is easy to understand. A one-time pad does not require electricity. If you lose your pad, that might be bad, but you don't have to revoke it in front of everyone. All of that sounds very useful, right?

So, to answer your question directly, "if we can find a suitable, secure way to generate and share unique keys, does the Vernam cipher become useful?"--yes, it already is very useful to certain people all over the globe, but they are not talking about it.

"Is there anything else that needs consideration in this respect?"

Yes.

1. It isn't that the key "should not" be used again, as if it were an option. It must only be used once.

2. The key must be at least as long as the plaintext.

3. The key must be truly random in order to be perfect.

4. The key must have been protected against damage or compromise.

5. The key must have been shared via a secure means.

• Love it! That’s an answer I can really understand. Out of curiosity, what’s your background? Feb 1, 2018 at 13:56
• Thank you, you are very welcome. On this topic there is one especially interesting website. You may already know it, that of Dirk Rijmenants. Search for his name and you will find it. Cheers! Feb 1, 2018 at 14:05
• +2. You seem to have an excellent appreciation of the true nature and use of a OTP. There are countless answers here dismissing them just because it's difficult to encrypt an entire 6TB drive's worth of porn. That's not what they're for. Feb 2, 2018 at 13:24

One important thing to note is that OTP does not provide integrity protection. That is pretty important as there is often a lot of known plaintext that, without integrity protection, an attacker can change at will.

For example, given document structures in say HTML, it would not be very hard for an attacker with write access to an OTP encrypted stream of HTML data to inject some malicious javascript.

I do want to focus in on one of your points, however

Keys need to be shared somehow

If we were able to solve that in an information theoretically secure way such that OTP became useful/practical, why would we not just use whatever way that was to transfer encrypted messages? Which would completely negate any usefulness of OTP, would it not?

• Information theoretically secure MACs exist so encrypt-then-mac would be entirely possible. (At the cost of exchanging three times as much key-material of course. But apparently we magically solved that problem somehow.) Jan 29, 2018 at 20:38
• @Maeher, agreed. Without details on how the "magic" works, it is hard to really answer a question on utility. Jan 29, 2018 at 20:44
• There is something called quantum key exchange which would, if it could be implemented, allow two quantum computers to be able to agree on a randomly-generated encryption key, but this key would be completely random and you couldn't send a message over the QKE channel. QKE is also information-theoretically secure given the laws of quantum physics. So it's definitely possible to create an perfectly secret channel that can be used for key exchange but not for sending messages. QKE + OTP + MAC would be a very powerful encryption system, but also a pretty expensive one. Jan 29, 2018 at 21:55
• Re. your last para. This is exactly what I was getting at posting crypto.stackexchange.com/q/53118/23115. Can a QKDN exchange a full pad? Jan 29, 2018 at 21:56
• @PaulUszak Sure, but now you have replaced the difficulty of exchanging keys with the enormous undertaking of connecting each pair of parties on a network with direct fiber-optic links. Jan 30, 2018 at 0:34

Is there anything else that needs consideration in this respect?

The keys need to be destroyed after they are used so that they cannot be recovered. This may seem obvious, but in practice it can be challenging.

if we can find a suitable, secure way to generate and share unique keys, does the Vernam cipher become useful?

If you can meet in person and exchange the keys via a physical medium, it can be useful with regard to the confidentiality of future messages. This is only applicable if you can meet your contact in person. This obviously does not scale well.

It also doesn't solve all of the other problems. Your keys will exist in at least two places in a medium that is hard to truly and reliably delete them from. The more places that your keys exist, the greater the risk for exposure and recovery. If you store the keys on a medium such as an SSD or CD, it may be difficult to properly delete the data.

You could store the pads on a piece of paper, which would make destroying them after use practical, but then you will have to deal with transcription errors and a severely limited amount of key material.

To quote the zen of python: "practicality beats purity"

Many talk about OTP in theoretical terms, but I'll point out some obvious practical considerations that make operating OTP encryption challenging:

1. OTP pads cannot ever be left out of your sight out custody: Are you going to leave your pads in a hotel room while you move around? Erm, no. They have to be carried on your person and the mere possession of these can identify you as a person of interest. Maybe the security services who intercept you pull out a pair of tin-snips and start cutting your fingers off to elicit "cooperation". So you can't leave the key material out of your sight, but carrying it on your person incurs risks.

2. Key Distribution: the act of transferring the keys leaves you vulnerable. If either party is already being watched, and you meet them to exchange key material, now your identity is compromised. Dead-drops won't mitigate this risk.

3. Timely Destruction of Key Material: As long as you hold onto that key material it's at-risk of compromise. People talk about just "burning" it, but is that possible in a hotel room with smoke detectors? ;-). So there's a window where the secure channel could be compromised.

Those are the (3) obvious practical issues that come to mind; probably loads of others. None of this is to say OTP encryption is bad- it's actually the gold standard of secure communications, but operating the system can be challenging to say the least.

• Calling anything "the gold standard" is asking for a flame war. It's certainly not the most used one and - after answering your question on OTP's - you must also be aware that it is not necessarily the most secure for most situations, even if you manage to avoid the practical issues that you've listed. PS I'm desperately trying to avoid the flame war with this comment, please do not ignite it anyway. Feb 11, 2019 at 18:46
• @MaartenBodewes I only used the phrase "gold standard" as a measure of uncrackable encryption- wasn't to say it was the most suitable for every use-case. I actually use GPG encryption for my own purposes. My intention certainly wan't to be provocative- Feb 12, 2019 at 9:52