In the 20th century, it was common for various intelligence agencies and military organizations to use ciphering machines and one-time pads.
However, no source I've seen ever mentions the process of generating the keys and printouts for such use.
Were there special machines for printing / punching them onto a card?
Where did the entropy they used come from?
Were there any significant breaches due to the bad randomness of the keys used?
Your interesting questions deserve to be answered more thoroughly, but here goes:
The German additive generator of wheels and switches had weaknesses that were brilliantly exploited by American analysts: the phases, cycles, potential overlaps, and limits of the keys became apparent after an exhaustive analysis of captured GEE one-time pads. By March 1, 1945, the U.S. was breaking GEE traffic because the German machine did not create truly random numbers--the Americans soon made a mirror machine based on key periodicity, other weaknesses, etc.
The released document (PDF) says that the GEE keys
…could be predicted in full upon partial recovery through cribs and superimposition to give a new kind of overlap.
Breaking GEE allowed the U.S. access into German diplomatic traffic at the end of the war, especially their dealings with Japan. (See the intriguing reference to uranium in one pre-August 6, 1945 transmission.)
Interestingly, the document says that the Germans could have easily defeated cryptanalysis by changing the set-up of the 240 wheels in the machine, but they never did! The Germans produced enormous amounts of key material without altering the basic set-up of the device. This led to "ample homogeneous material" being created.
During the Cold War, the Soviets were known to generate one-time pads by having rooms full of typists peck away "randomly." That's not genuinely random, but still formidable because such results are--as another writer said--from different people and can be muddled further. For those who disparage one-time pads, consider this: the NSA refers to the day when the Soviets started using one-time pads in "...all high-level Soviet communications, including the mainline military, air force, and navy nets" for radio traffic--October 29, 1948--as Black Friday, which immediately "...ravaged the cryptologic landscape...". (See page 19 of The National Cryptologic School's "On Watch", 9-86) Nevertheless, there are instances in which critical key weaknesses helped cryptanalysts exploit key misuse during the Cold War.
Early U.S. efforts to generate random numbers and marry those to plaintext (Telektypton, 1933) depended on a typist and keyboard, a natural but faulty way to think about the problem. Importantly, the Telekrypton had other weaknesses, such as a looped keystream. What is so interesting about Telekrypton is that it was widely used, highly regarded, and deeply flawed. After World War II, the idea of using noise for entropy in key generation was made and used by British Intelligence. The man who figured this out retired from GCHQ in the 1980's. The generator based on his ideas has been regarded as the first to generate truly random keys.
If you consider that the quality of randomness can only be assessed in proportion to the size of the data sample, you'll realise that it's not really that hard to make random numbers. Depending of course on how many you want. You have to change mindset from today. One time pads were not (and should not be) used to encrypt a 6TB hard drive's worth of porn.
I think in the early days, WW1ish time, they were made by ladies randomly typing at typewriters. If a pad's page only contains 250 numbers, that can be fairly easily be bashed out on a manual keyboard. If different individuals produce different pages, that should even out unconscious patterns. I've read this somewhere but can't find a reference. But if you try it yourself, you'll see it's easy. And how can you disprove the randomness of 250 characters that were typed randomly on purpose? You can't as historical archives show.
Later they had electro-mechanical randomising devices relying on timing a switch's contact bounce which is fairly random, and produced numbers at 35 bits/s. The following is an extract:-
and the following is the Hewlett-Packard 522B counter instrument. You can see the random numbers on the neon display:-
Later during the SIGSALY days, vacuum tube diodes were used to create electrical noise which was digitised. The key material was then distributed on a phonographic record. Users could talk for 12 minutes per record.
And whist the British Post Office is not the NSA, there's ERNIE which is a Premium Bond picker-outer machine. He's moved on now to solid state diodes photon counting, but ERNIE 1 (1956) did it with these valves:-
V1 (extreme left) is the noisy valve. Interestingly, we still use the same circuit today. We just swap the vacuum tubes for transistors.
I'm not aware of any security breaches of a OPT other than the breaking of the GEE German Diplomatic code during WW2. All of the documented instances like (Venona) relied upon duplicated key material, not poor entropy from the typist. The proof of this is that no OTPs prior to the pad duplication mistake in 1942 have been decrypted.
This procedure, though not entirely random theoretically, did serve as one-time pad generator.
At the exhibition, besides many interesting encryption machines, a copy of the book “Achtung Spione” was on display. This book (divided in two large volumes) contains much interesting information about espionage in the early Cold War. Cryptology only plays a minor role in it. However, one picture in the book immediately caught my attention. On page 252 of the second volume the following device is shown (for copyright reasons I have to use a different picture here, but it’s the same motif):
This device is a mechanical random number generator named “Violine” (German for “violin”). It is mentioned in my book Codeknacker gegen Codemacher. The Violine was used by the West German cipher authority in the 1950s. While it is clear that this device produces five digit random numbers, I have always been wondering what exactly it was used for.
In the afore-mentioned book I found the (likely) answer. Below the picture it says: “Violine […] for the simple use of the secure encryption algorithm ‘DEIN STAR’.”
In fact, the German secret service used a manual encryption algorithm named DEIN STAR in the 1950s. DEIN STAR is a variation of the One Time Pad. It was used by spies for encrypting short messages. It was secure and didn’t require treacherous crypto devices. How DEIN STAR works is explained on Jörg Drobick’s website.
