I understood that One-Time Pad (OTP) encryption ensures perfect secrecy. However, I couldn't find any real-world examples where the OTP is used.

Also, which are some real-world examples where it won't be suitable to use an OTP.


If you want to have the perfect secrecy then it is the only choice. However, it doesn't have integrity and authentication.

If you want to see when it is used, see OTP at Wikipedia, especially the cold war era.

It is not suitable for modern usage, where a lot of messages is sent/received. The drawback is the necessary condition; key length must be at least message length. Also, you must somehow transmit the OTP key securely, not by encryption. You must trust the carrier or you have to carry yourself.

A simple question arises what will you do when the keystream is depleted? Would you wait for the new key, or you would re-use some part of the keystream? Both have critical results. You will not communicate when needed or OTP will fail, see Crib-Dragging.

  • Per comment: There is an interesting question on this site; Is there a companion algorithm for OTP to ensure integrity and/or authentication?, asking the companions for integrity and authenticity since the OTP only provides confidentiality. Clearly, If you send your data only encrypted with OTP, the Oscar, the middle man, can modify the message. Of course, if he has no knowledge of the structure of the data, the modifications are random. In the other case, the results can be catastrophic. Save the man can be converted into Kill the man.

    As some said, (most of | sometimes,) the time integrity is more important the confidentiality. You may not need encryption but integrity is almost necessary.

| improve this answer | |
  • 1
    $\begingroup$ What is the reason for the downvote? $\endgroup$ – kelalaka Feb 21 '19 at 22:50
  • $\begingroup$ Doesn't possession of the encryption key count as integrity / authentication? (Hint: it does) $\endgroup$ – John Dvorak Feb 22 '19 at 16:56
  • 4
    $\begingroup$ @JohnDvorak No. $\endgroup$ – Future Security Feb 22 '19 at 19:45
  • 4
    $\begingroup$ @JohnDvorak It does not. An OTP, like an unauthenticated stream cipher, is malleable. $\endgroup$ – forest Feb 23 '19 at 10:01
  • 3
    $\begingroup$ The cited question makes it sound somewhat obscure, but actually the one-time authenticator model is used pretty much as ubiquitously as the one-time pad model: the AES-GCM or ChaCha-Poly1305 authenticated ciphers you're probably using to talk to the crypto.stackexchange.com server with TLS both make use of OTA- and OTP-based construtions simultaneously, using an OTA to authenticate the OTP ciphertext. $\endgroup$ – Squeamish Ossifrage Feb 23 '19 at 16:39

OTPs are making quite a resurgence these days as a fundamental product of quantum key distribution networks using the BB84 protocol. It's worth explaining where the OTP fits in with that protocol. Consider the following arrangement:-


Alice has a photonics based true random number generator (an essential component of OTPs) . Those bits randomly select polarised photons /qubits passing to Bob, forming a candidate key. The candidate key is received, error corrected and sifted reducing its length. What remains is a key known to both Alice and Bob suitable for future OTP work.

When QKD was developed, the sifted key transmission rate was only a few kbps so the key was used as a conventional symmetric key for external speed enhancement. Things have moved on and generation rates are of the order of 1Mb/s. Field test of quantum key distribution in the Tokyo QKD Network details a working secure video conferencing system in Tokyo running entirely via OTPs. The paper also details work on secure OTP based smart phones. This is another (NIST) video surveillance system based on OTPs.

And the Tokyo paper was published in 2011. The equipment will have shrunk and improved and the exchange protocols will have been refined. OTPs will inevitably become more commonplace, especially given the allure of information theoretic security.

To the counter; since a lot of hardware is required including true random number generators, OTPs are not really suitable for the consumer yet. 8K UHD movies are not currently the best use case for OTPs. But who can predict the future? A Netflix QKDN? A lot of people have fibre to the premises, so it's feasible. And a true random generator can fit into tweezers as does the Swiss chip below:-



"I think there is a world market for about five computers."

-- Thomas J Watson, President IBM.

| improve this answer | |
  • 3
    $\begingroup$ It should be noted that at least some of the companies that offer QKD such as idquantique actually don't use QKD for OTPs, but use AES instead (for the same reason we do the same in "classic" cryptology: practicality) $\endgroup$ – Ella Rose Feb 22 '19 at 1:36
  • 2
    $\begingroup$ In the BB84 protocol, OTPs are not used in the key distribution process, but would be the output of the key distribution process. To quote the idquantique link above: "It works by sending photons, which are “quantum particles” of light, across an optical link", and "... In theory, QKD should be combined to One-Time Pad (OTP) encryption to achieve provable security. However in practice ... QKD is combined with conventional symmetric encryption, such as AES, and used to frequently refresh encryption keys.". Anyways, as usual, comments are not for conversations, etc; use chat instead. $\endgroup$ – Ella Rose Feb 22 '19 at 2:04

When you browse to https://crypto.stackexchange.com/ or https://bankoffreedonia.com/, your browser almost certainly uses a one-time pad generated by AES-256 or ChaCha or similar to encrypt the messages exchanged with the server. We call this method of generating a one-time pad a ‘stream cipher’. It turns out to be about the least interesting part of how TLS and HTTPS works, which is why you don't hear much about it!

In particular, the one-time pad model is just to encrypt the $n^{\mathit{th}}$ message $m_n$ with a pad $p_n$, chosen at random for each message with some low statistical distance from uniform and never again used for any other purpose, by setting the ciphertext to be $c_n = m_n \oplus p_n$, where $\oplus$ is xor.

The security arises from the inability of the adversary to guess $p_n$: it is bounded by the statistical distance of the pad from uniform. ‘Perfect security’ or ‘perfect secrecy’, in this case, is the theoretically optimal statistical distance, which is zero—not something necessarily attainable in practical terms, but a theoretical property of the model. Cranks will often play up how their one-time pad systems have perfect security because everyone has heard of one-time pads and perfect secrecy sounds awesome—but they will play down how their methods of generating pads are hare-brained schemes that don't survive scrutiny; the use of xor at the end is the least interesting thing about it.

Because it is difficult and costly to get a uniform distribution on a large number of bits by observing random processes in the real world, and even more difficult and costly to for two parties to agree on them and exchange them, we instead pick a small number of bits $k$ from a space nevertheless so vast nobody will ever guess the same key by chance even if they spent enough energy trying guesses to boil the oceans. Then we compute the pad $p_n = F_k(n)$ where the function $F$ might be AES-256 in CTR mode, or ChaCha, or what have you—the technical term is that $F$ should be a pseudorandom function family. AES-256 and ChaCha have been studied for decades to conclude that it is unimaginably difficult to distinguish $F_k(n)$ from uniform random when $k$ is close enough to uniform random. It's then a tiny, mundane, and ubiquitous idea to xor it with the message to encrypt a message.

Of course, if you make a bad choice of $F$ like a Vigenère cipher, or if you foolishly attempt to generate $p_n$ by banging on the keyboard like a monkey, then you don't get much security. This is how historical cryptography using one-time pads was broken, long before the invention of AES-256 or ChaCha.

The one-time pad model is one of many simple probabilistic models in cryptography that we instantiate in practice. We have an ideal model; a theorem about the model; and a practical instantiation of the model. Here are some examples:

  • Cipher block chaining is model for using a uniform random function $f$ of $b$-bit strings to $b$-bit strings to make a nearly uniform random function $\operatorname{CBC}_f$ on an $n$-block message $m$ given by $$\operatorname{CBC}_f(m) = f(\dots f(f(\mathit{iv}_n \oplus m_1) \oplus m_2) \dots \oplus m_n),$$ where $\mathit{iv}_n$ is a short uniform random string. There is a standard theorem (e.g., [1], Theorem 3.1, Information-Theoretic Case) about the probability any algorithm $A$ can distinguish this from a uniform random function $g$ of $nb$-bit to $b$-bit strings: $$\Pr[A(\operatorname{CBC}_f)] \leq \Pr[A(g)] + 1.5\cdot q^2 n^2/2^b,$$ where $q$ is the number of times $A$ evaluates the function.

    Nobody clamors to choose $f$ among all possibilities uniformly at random by examining bird entrails, store a description of it, and then compute CBC on it: we just use $f = \operatorname{AES256}_k$ for a short uniform random key $k$ without fanfare.

  • The one-time authenticator is a model for using a uniform random message-length key to detect forgery[2][3][4]: if $m = m_1 \mathbin\| m_2 \mathbin\| \dots \mathbin\| m_\ell$ is a message of $\ell$ blocks of $b$ bits apiece, and the key $s, a_1, a_2, \dots, a_\ell$ is a collection of $\ell + 1$ independent uniform random $b$-bit blocks, then, interpreting both as vectors in $\operatorname{GF}(2^b)$, the authenticator $$s + m_1 a_1 + \dots + m_\ell a_\ell$$ can't be forged on any message other than $m$ with probability better than $2^{-b}$ by any adversary who doesn't know the key.

    Nobody clamors to choose $s, a_1, \dots, a_\ell$ among all possibilities uniformly at random by tossing I Ching sticks, store it, and transport it by courier; we just use $s = \operatorname{AES256}_k(0)$ and $a_i = r^i$ where $r = \operatorname{AES256}_k(n)$ for the $n^{\mathit{th}}$ message without fanfare. (There's a good chance your browser is doing this right now with https://crypto.stackexchange.com/ in tandem with the one-time pads it generates with AES or ChaCha!)

  • The one-time pad is a model for using a uniform random message-length key to conceal a message from an eavesdropper, as above.

    No serious cryptography practitioner clamors to choose the key among all possibilities uniformly at random by reading tea leaves, store it, and transport it by courier; we just generate it with AES or ChaCha under a short uniform random key $k$ without fanfare.

    Yet somehow this particular model has attained mystical status in the broader culture as transcending cryptography, a mistake that leads people to shoot themselves in the foot by accidentally reusing pads because they're too unwieldy or by using a broken bespoke key generator like a Vigenère cipher—instead of using modern cryptography to choose them securely from an easily managed short uniform random secret.

    We call this composition a stream cipher, and it actually works so reliably that just about everyone uses it every day for net petabytes of data transfer, protecting trillions of euros of economic value, personal privacy, etc. This is a wild success of the one-time pad model! The only way practical systems using it have been broken is by exploiting mistakes of pad generation, not by anything about the one-time pad model.

| improve this answer | |
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$ – Ella Rose Feb 23 '19 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.