What are some real-world examples where one-time-pad encryption is used or can be used?

Question

I understood that one-time-pad (OTP) encryption ensures perfect secrecy. However, I couldn't find any real-world examples where an OTP was used.

Also, what are some real-world examples where it won't be suitable to use the OTP.

Answer 1

If you want to have the perfect secrecy then it is the only choice. However, it doesn't have integrity and authentication.

If you want to see when it is used, see OTP at Wikipedia, especially the cold war era.

It is not suitable for modern usage, where a lot of messages is sent/received. The drawback is the necessary condition; key length must be at least message length. Also, you must somehow transmit the OTP key securely, not by encryption. You must trust the carrier or you have to carry yourself.

A simple question arises what will you do when the keystream is depleted? Would you wait for the new key, or you would re-use some part of the keystream? Both have critical results. You will not communicate when needed or OTP will fail, see Crib-Dragging.

• Per comment: There is an interesting question on this site; Is there a companion algorithm for OTP to ensure integrity and/or authentication?, asking the companions for integrity and authenticity since the OTP only provides confidentiality. Clearly, If you send your data only encrypted with OTP, the Oscar, the middle man, can modify the message. Of course, if he has no knowledge of the structure of the data, the modifications are random. In the other case, the results can be catastrophic. Save the man can be converted into Kill the man.

  As some said, (most of | sometimes,) the time integrity is more important the confidentiality. You may not need encryption but integrity is almost necessary.

Answer 2

OTPs are making quite a resurgence these days as a fundamental product of quantum key distribution networks using the BB84 protocol. It's worth explaining where the OTP fits in with that protocol. Consider the following arrangement:-

Alice has a photonics based true random number generator (an essential component of OTPs) . Those bits randomly select polarised photons /qubits passing to Bob, forming a candidate key. The candidate key is received, error corrected and sifted reducing its length. What remains is a key known to both Alice and Bob suitable for future OTP work.

When QKD was developed, the sifted key transmission rate was only a few kbps so the key was used as a conventional symmetric key for external speed enhancement. Things have moved on and generation rates are of the order of 1Mb/s. Field test of quantum key distribution in the Tokyo QKD Network details a working secure video conferencing system in Tokyo running entirely via OTPs. The paper also details work on secure OTP based smart phones. This is another (NIST) video surveillance system based on OTPs.

And the Tokyo paper was published in 2011. The equipment will have shrunk and improved and the exchange protocols will have been refined. OTPs will inevitably become more commonplace, especially given the allure of information theoretic security.

To the counter; since a lot of hardware is required including true random number generators, OTPs are not really suitable for the consumer yet. 8K UHD movies are not currently the best use case for OTPs. But who can predict the future? A Netflix QKDN? A lot of people have fibre to the premises, so it's feasible. And a true random generator can fit into tweezers as does the Swiss chip below:-

Remember:-

"I think there is a world market for about five computers."

-- Thomas J Watson, President IBM.

Answer 3

Real-world examples in which the OTP has been used:

1. In 1998, five Cuban intelligence officers of the Dirección de Inteligencia (DI), "The Wasp Network," were arrested by the FBI in the United States, and it was discovered that they had been receiving one-time-pad messages from a numbers station in Cuba called Atención, which transmitted at 17480 kHz. As of 2015, that station was still in operation. I am not sure whether it is still up and running.

2. Ana Belen Montes, a senior intelligence analyst at the DIA (Defense Intelligence Agency), was arrested on 21 September, 2001, for spying against the United States while working for the Cuban government. She communicated with her handler in Cuba over HF radio (7877 kHz) using a one-time pad.

3. Using one-time-pad encryption for military purposes is sometimes publicly discussed. See M. Borowski, R. Wicik, “A One-time Cipher Machine for the Polish Army,” Military Communication Conference, Prague, 2008; and Borowski's "Szacowanie sił mechanizmów kryptograficznych zastosowanych w module kryptograficznym polskiej radiostacji programowalnej Guarana". Przegląd Telekomunikacyjny - Wiadomości Telekomunikacyjne, 2015, nr 8-9. Whether it has been implemented is difficult to say.

4. In Generation of random keys for cryptographic systems Borowski, Leśniewicz, Wicik, and Grzonkowski point out that electro-mechanical cipher machines using a one-time pad were manufactured from the fifties to the seventies "...and widely used in diplomacy" and in various militaries "on the highest levels of command." They also say that "A famous example of one-time pad's security is the Washington/Moscow hotline with the ETCRRM II (Electronic Teleprinter Cryptographic Regenerative Repeater Mixer) installed in 1963, a standard commercial one-time tape mixer for telex."The authors name several cryptographic systems that use the one-time-pad principle: American TELEKRYPTON, B-2 PYTHON and SIGTOT, the British BID-590 NOREEN and 5-UCO, the Canadian ROCKEX, the Dutch ECOLEX series, the Swiss Hagelin CD-57 RT [using its one-time random tape option, thus "RT"], the German Siemens T-37-ICA and M-190, the East German T-304 LEGUAN, the Czech SD1, the Russian M-100 SMARAGD and M-105 N AGAT and the Polish T-352/T-353 DUDEK.

5. They could have also mentioned the Hagelin CX-52, which had a tape reader for one-time tapes. The T-55 also used a one-time tape, and it was in production until 1956.

6. The United States Air Force operates the High Frequency Global Communications System (HF-GCS), on which it sends Emergency Action Messages (USB; 4724.00 kHz, 6739.00 kHz, 8992.00 kHz, 11175.00 kHz (primary), 13200.00 kHz, 15016.00 kHz, 6712.00 kHz). Some recordings can be heard here. The OTP is suitable for voice communications. Some of the tactical call signs sound a bit ominous; for example, TRINITY and WAITER.

7. Many countries have operated numbers stations for military and intelligence-related transmissions, but they are not as widely used as before 2010. A good example is the Russian station UVB-76, which "stopped broadcasting in August 2010 and remains silent since then. The transmitter site is located near Povarovo, 40 km (25 mi) north-west of Moscow, and now appears abandoned." But there are sometimes surprises: this North Korean station made a broadcast in 2017 (AM radio):

From now, we will send IT Basic Practice problems for Agents No. 27. Now, we will tell the number of problems. 82369 46792 957100 83007 69489 42995 91639 34748 68442 91741 75470 14623 88398 98043 67261 07525 224247 41266 45539 81349 66189 58297 11175 47043 51249 28790 88064 04483 51956 90795 11211 27525 68672 08691 94821 17324 84531 84489 75008 61197 28402 19004 37253 11623 71017 33945 41178 77521 79751 37813 02155 81261 63943 92681 971100 76350 05892 66228 71794 33954 51868 16720 12192 22016 55895 73804 72387 59933 71919 86273 41257 16693 06485 97120 85690 58136 10182 47795 11289 13245 93964. We will repeat. (Same Numbers). That is all.

And at least they had a sense of humor:

“Now we’ll begin a mathematics review assignment for members of the 27th expeditionary unit of the distance learning university,”

“Turn to page 459, question 35; 913, question 55; 135, question 86.”

8. The underground African National Congress was supported by a network of Dutch activists and South Africans who communicated over public telephone lines using one-time-pad encrypted ciphertext in DTMF tones. The main operator was a clever fellow named Tim Jenkins. One read more about Jenkins and his intelligence operation on this website.

When can it be used?

Perhaps when confidentiality is life-or-death. Perhaps over a radio. The OTP has many advantages and many disadvantages. In an environment of active attack and heavy electronic surveillance in which the sender and receiver want to avoid absolutely everything that operates by electricity ("Fine Dining", etc.), the OTP may be the way to go.

Where it should not be used

The key has to be at least as long as the plaintext. Any large file is going to require a long key. Such weighty keys would need to be stored and processed.

The one-time pad is rarely suitable for the purposes of modern encryption, but as Squeamish said, as a model it has survived.

---

Edit:

Another time that it should not be used is when malleability is a concern.

Answer 4

When you browse to https://crypto.stackexchange.com/ or https://bankoffreedonia.com/, your browser almost certainly uses a one-time pad generated by AES-256 or ChaCha or similar to encrypt the messages exchanged with the server. We call this method of generating a one-time pad a ‘stream cipher’. It turns out to be about the least interesting part of how TLS and HTTPS works, which is why you don't hear much about it!

In particular, the one-time pad model is just to encrypt the $n^{\mathit{th}}$ message $m_n$ with a pad $p_n$, chosen at random for each message with some low statistical distance from uniform and never again used for any other purpose, by setting the ciphertext to be $c_n = m_n \oplus p_n$, where $\oplus$ is xor.

The security arises from the inability of the adversary to guess $p_n$: it is bounded by the statistical distance of the pad from uniform. ‘Perfect security’ or ‘perfect secrecy’, in this case, is the theoretically optimal statistical distance, which is zero—not something necessarily attainable in practical terms, but a theoretical property of the model. Cranks will often play up how their one-time pad systems have perfect security because everyone has heard of one-time pads and perfect secrecy sounds awesome—but they will play down how their methods of generating pads are hare-brained schemes that don't survive scrutiny; the use of xor at the end is the least interesting thing about it.

Because it is difficult and costly to get a uniform distribution on a large number of bits by observing random processes in the real world, and even more difficult and costly to for two parties to agree on them and exchange them, we instead pick a small number of bits $k$ from a space nevertheless so vast nobody will ever guess the same key by chance even if they spent enough energy trying guesses to boil the oceans. Then we compute the pad $p_n = F_k(n)$ where the function $F$ might be AES-256 in CTR mode, or ChaCha, or what have you—the technical term is that $F$ should be a pseudorandom function family. AES-256 and ChaCha have been studied for decades to conclude that it is unimaginably difficult to distinguish $F_k(n)$ from uniform random when $k$ is close enough to uniform random. It's then a tiny, mundane, and ubiquitous idea to xor it with the message to encrypt a message.

Of course, if you make a bad choice of $F$ like a Vigenère cipher, or if you foolishly attempt to generate $p_n$ by banging on the keyboard like a monkey, then you don't get much security. This is how historical cryptography using one-time pads was broken, long before the invention of AES-256 or ChaCha.

---

The one-time pad model is one of many simple probabilistic models in cryptography that we instantiate in practice. We have an ideal model; a theorem about the model; and a practical instantiation of the model. Here are some examples:

• Cipher block chaining is model for using a uniform random function $f$ of $b$-bit strings to $b$-bit strings to make a nearly uniform random function $\operatorname{CBC}_f$ on an $n$-block message $m$ given by $$\operatorname{CBC}_f(m) = f(\dots f(f(\mathit{iv}_n \oplus m_1) \oplus m_2) \dots \oplus m_n),$$ where $\mathit{iv}_n$ is a short uniform random string. There is a standard theorem (e.g., [1], Theorem 3.1, Information-Theoretic Case) about the probability any algorithm $A$ can distinguish this from a uniform random function $g$ of $nb$-bit to $b$-bit strings: $$\Pr[A(\operatorname{CBC}_f)] \leq \Pr[A(g)] + 1.5\cdot q^2 n^2/2^b,$$ where $q$ is the number of times $A$ evaluates the function.

  Nobody clamors to choose $f$ among all possibilities uniformly at random by examining bird entrails, store a description of it, and then compute CBC on it: we just use $f = \operatorname{AES256}_k$ for a short uniform random key $k$ without fanfare.

• The one-time authenticator is a model for using a uniform random message-length key to detect forgery[2][3][4]: if $m = m_1 \mathbin\| m_2 \mathbin\| \dots \mathbin\| m_\ell$ is a message of $\ell$ blocks of $b$ bits apiece, and the key $s, a_1, a_2, \dots, a_\ell$ is a collection of $\ell + 1$ independent uniform random $b$-bit blocks, then, interpreting both as vectors in $\operatorname{GF}(2^b)$, the authenticator $$s + m_1 a_1 + \dots + m_\ell a_\ell$$ can't be forged on any message other than $m$ with probability better than $2^{-b}$ by any adversary who doesn't know the key.

  Nobody clamors to choose $s, a_1, \dots, a_\ell$ among all possibilities uniformly at random by tossing I Ching sticks, store it, and transport it by courier; we just use $s = \operatorname{AES256}_k(0)$ and $a_i = r^i$ where $r = \operatorname{AES256}_k(n)$ for the $n^{\mathit{th}}$ message without fanfare. (There's a good chance your browser is doing this right now with https://crypto.stackexchange.com/ in tandem with the one-time pads it generates with AES or ChaCha!)

• The one-time pad is a model for using a uniform random message-length key to conceal a message from an eavesdropper, as above.

  No serious cryptography practitioner clamors to choose the key among all possibilities uniformly at random by reading tea leaves, store it, and transport it by courier; we just generate it with AES or ChaCha under a short uniform random key $k$ without fanfare.

  Yet somehow this particular model has attained mystical status in the broader culture as transcending cryptography, a mistake that leads people to shoot themselves in the foot by accidentally reusing pads because they're too unwieldy or by using a broken bespoke key generator like a Vigenère cipher—instead of using modern cryptography to choose them securely from an easily managed short uniform random secret.

  We call this composition a stream cipher, and it actually works so reliably that just about everyone uses it every day for net petabytes of data transfer, protecting trillions of euros of economic value, personal privacy, etc. This is a wild success of the one-time pad model! The only way practical systems using it have been broken is by exploiting mistakes of pad generation, not by anything about the one-time pad model.