Does a playlist of songs or movies mixed together contain enough random enough for OTP key material?

Question

Ok hypothetical scenario. Lets say I want to generate a lot of key material quickly for a one-time pad. This key material will be divided up and used for many different messages in the future.

1. I select 50-100+ songs out of a custom playlist of all my music. The music has been converted to basic Waveform Audio File Format (.wav). The music could be a mix of rock, pop, classical, techno etc just whatever I selected.

2. I extract every song's raw music data out into one big file and remove null bytes. Now I have a single big file with all of the song data in it.

3. I randomize all of the song data so all the song data is blended together into an unintelligible sequence of bits. The user can provide some input using their mouse/keyboard which will provide some entropy into the randomizing function.

4. I loop through all the data in the file, taking every ~7th byte (or bit) and put it into another file which is now my new key material. This step could be altered so the user can provide a variable sample rate, e.g. they can change it to every 10th byte or 100th byte.

Now... is that file of key material sufficiently random for one-time pad use?

What about if I changed out music songs and use 10+ full length movies or TV shows instead?

Answer 1

The bits are not independent from each other, at least within an individual song, so the pad is not truly random, thus this is not a one-time-pad. Perhaps a hash-based approach would fix this, but...

... there are a limited number of songs available, a simple attack would then be to enumerate every song (in the same format you describe) and try to decrypt a portion of the ciphertext (e.g. try bits 0 to 10, then try bits 1 to 11, etc... until you get something meaningful). Therefore the ciphertext can be broken by brute force, it is then not a one-time-pad by definition.

You'll notice your initial permutation had no effect on the efficiency of this attack. But even if it did, you must use some source of randomness to shuffle your song list, right? If you used a PRNG, someone could break that, and deduce the permutation you used. That's another dangerous "moving part". And if you had a true randomness source, then why not use it to create the pad in the first place?

Also, presumably you don't want to destroy your music after you've made it into a "one-time-pad", so your pad would also exist in its more explicit form on your hard drive -> big security risk (it considerably simplifies the attack above, as we now know exactly which songs to try to decrypt the ciphertext with).

Bits are bits, and entropy is entropy. It doesn't matter whether the data represents music or TV shows - those are human concepts whereas theoretical cryptography is intrinsically an abstract science.