# Why does the key for a one-time pad have to be uniformly distributed? [duplicate]

I would like an intuitive argument for what goes wrong in the proof that that a one-time pad provides perfect secrecy, if the key $$K$$ is not chosen uniformly at random from the entire key space.

• i don't understand it. – john Oct 7 '18 at 9:49
• you seem to be asking a series of basic related questions without putting much effort into showing what you have tried, where you are stuck, etc. – kodlu Oct 7 '18 at 10:16
• Please note that we expect at least a minimal amount of effort here for a question to be well-received. This includes ideally showing what you have tried yourself and where exactly you hit a problem, so we can specifically address that instead of guessing what your problem is and then probably miss-guessing. So please edit your question to explain why you don't understand the question kelalaka linked, so we can help you from there. – SEJPM Oct 7 '18 at 11:49
• To be fair, I don't think the question @kelalaka linked is an exact duplicate, even if it's quite close. AFAICT we don't seem to have a clear and concise answer to this basic question in its general form yet, so I've provided one below (and tidied up the question a bit in the process). – Ilmari Karonen Oct 8 '18 at 2:12
• The distribution doesn't have much to do with the requirement of a truly random key. The answer in this case is: we do not expect the message to have any specific distribution. And the only way we can get a uniform distribution in the ciphertext is if the key is uniformly distributed (and the bits are statistically independent). Another point of view: for any other distribution, the entropy is strictly less than the length. – tylo Oct 8 '18 at 10:34

## 2 Answers

Intuitively, each key decrypts the ciphertext to a different plaintext. So if some keys are more likely than others, then some plaintexts will also be more likely than others. Thus, unless all possible keys (and thus all possible plaintexts) are equally likely, observing the ciphertext will reveal information about the plaintext.

(Note that I'm implicitly assuming above that the attacker has no prior knowledge of what the plaintext might be before observing the ciphertext. That's fine for a counterexample, since a cipher that provides perfect secrecy must by definition reveal no new information about the plaintext to any attacker. So if we want to show that a cipher does not provide perfect secrecy, it's enough to show that it can reveal some information about the plaintext to some attacker.)

• Actually, if we assume no knowledge of the plaintext, then we can argue like this: if the plaintext is drawn from a uniform distribution, then the ciphertext is also uniform - regardless from which distribution the key is drawn. But we security without such a restriction on the plaintext. – tylo Oct 8 '18 at 10:39
• @tylo If you can infer that the ciphertext is well distributed while the key stream is not then you're already leaking information about the plaintext: the fact that it is well distributed is information by itself. Or maybe you were trying to say this; I cannot parse that last sentence of your comment :) – Maarten Bodewes Oct 9 '18 at 12:56

Let's say you have a commander ask the general "should I attack at 1pm via the tunnel". The adversary knows the general is brief and will only respond with "y" or "n". If the key is not uniformly distributed then the bias of the key can be directly related to the likelyhood of the general's response.

Not bad enough? Let's say there are twenty commanders asking the same question. "y" can be represented as 1 if you'd like and "n" as 0. You are the adversary and know the supposed one time pad key is actually 0 with probability 0.6 and 1 the other (0.4) times. You observe 12 ciphertexts of 1 and 8 ciphertexts of 0. Do you invest your forces preparing for an attack? How likely is it the general answered yes? These are questions to think on and even answer concretely as an exercise.