So I've been reading about cryptography and one-time pads, which seem to provide theoretically perfect secrecy. My question is does any form of technology today allow data to be stored in a practical way such that information is destroyed upon reading it? I think that magnetic core memory works in a similar way:

To read the value of a core, the core was flipped to the 0 state. If the core was in 1 state previously, the changing magnetic field produced a voltage in the sense wire threaded through the cores. But if the core was in the 0 state to start, the sense line wouldn't pick up a voltage. Thus, forcing a core to 0 revealed the core's previous state (but erased it in the process)

Text source

• For magnetic cores, an adversary with access to that can read the information and then just write it back while keeping the information. The only thing that can't be copied without noticing is qbits in quantum key exchange, as far as I am aware. – tylo Sep 23 at 7:00
• As you can see the current answers kind of focus on hardware solutions; it won't be easy - if at all possible - to find an algorithmic solution to the problem. – Maarten Bodewes Sep 23 at 17:44
• @PaulUszak No, entanglement still doesn't allow you to send information faster than light speed. There's better explanations than I could provide in a comment in numerous places across the internet, if you're interested. – mbrig Sep 23 at 20:42
• I'm voting to close this question as off-topic because this seems to be a question about electrical engineering or physics, not about cryptography. – Squeamish Ossifrage Sep 24 at 0:28
• One relevant aspect is that in the classic OTP solutions even if the key material is destroyed after encryption, the sender can trivially recover the key if he has access to both plaintext and cyperthext, which often will be the case. – Peteris Sep 24 at 1:41

There are two paths in hardware that would be possible without doing something exotic.

Erase the actual bits.

Blow the bank.

• Erase: When I make analog floating-gates, I use classical physics to program them (put charge on the gate) and a quantum effect of tunneling to pull charge off (make the gate positive). I could tunnel and read concurrently which would erase the bank. This would allow the memory to be reusable and volatile on read. You cannot get the information back.

• Blow: When we make digital memory, we read banks. 64k is one of my tiles, the other is 1M. It just depends on who made the blocks. I could make the "read" counter tied to an overflow that would blow an e-fuse. You could repair this (with a lot of cost) using a FIB.

• blow the bank :) – kelalaka Sep 23 at 17:56
• @kelalaka yeah, but that's what we say. :P Thanks for the formatting. I was hastily trying to get an answer in there before a meeting. – b degnan Sep 24 at 0:02

Practically speaking, I think that - in the realm of cryptography - a HSM is the closest that you can get. A HSM is a tamper-proof box that destructs or disables the keys and data stored within it when it detects distortion.

Of course a HSM is a practical device; it doesn't provide information theoretic certainty that the information will be destroyed. Although it operates as a black box, it is still a physical device and there are certainly attack vectors on it. Internally it is just a computer in a tamper resistant box. These expensive devices are protected against many kinds of side channel attack. They also try and resist transport, by detecting movement and by destroying all data if the power is removed from them (they commonly include a battery / ultra capacitor to store power to do so, or they rely on volatile RAM in the first place. There are cheaper / more limited devices that simply rely on a smart card chip to perform the same functionality; these often are in the form of a largish USB-stick.

One trick you can perform once you have a secure key store that provides cryptographic operations on the keys is to encrypt data with such a key. You could put a limit on the key usage, say 2 - once for writing, once for reading - for symmetric keys, or just 1 usage for a private key decryption. That way the device will prevent user access to the key once it is used to (partially) decrypt the data. As long as the encryption algorithm stays secure, it will become practically impossible to decrypt any data protected by that particular key.

Of course, the entity that just read the data now has the responsibility of keeping the information confidential. I can read a book and then burn it, but now the information in the book is (partially and inefficiently) stored in my memory after all. Reading data does mean that the data is duplicated in another location; reading fundamentally doesn't seem to be destruction of information, rather the propagation of information.

In short, no, I don't think we have a way to do this, but cryptography can certainly help by limiting the requirements for destruction to just a key rather than, for instance, a disk full of information.

• Though of course this HSM approach can't be used with Andrija's one time pad. – Paul Uszak Sep 23 at 15:26
• Um, well, you can store the OTP in a HSM for sure, similar to any other key. But I think the notion of a one-time pad is a bit strained when it comes to destruction of data anyway. So I agree, the relation is as good as not there in my answer, but I wonder how much of it is present in the question. – Maarten Bodewes Sep 23 at 15:31
• @PaulUszak you certainly could use a (non-standard, with a larger memory) HSM in this way for one-time pads, mirroring the same procedures that we currently use for physical HSMs - a secure 'key ceremony' to load the key material in it (which is a one-way operation), and afterwards the only operation that the HSM can do with it would be to encrypt data with that one-time pad once and irrevocably delete corresponding key data. After the one-time pad is exhausted, you'd have to reset the HSM, but that's kind of unavoidable for one-time pads, and key resets is something current HSMs can do. – Peteris Sep 23 at 23:29

Ferroelectric RAM is a modern analog to magnetic core memory, from the standpoint that reading it looses the information previously stored (source). Usually there is on-die write-after-read circuitry to prevent information loss (much like that was built in core memory controllers). If that circuitry was removed we'd get a read-once memory.

On the other hand, it is quite possible that a forensic examination of the memory cell with sensitive-enough instruments (Scanning Tunneling Microscope perhaps) would allow recovery of the previous information even after a read; and there's noting to prevent externally making a copy of the information read.

A system that I've worked on uses a spinning hard disk (not SSD or hybrid). The OTP key material is stored on the disk and there is also the outbound encrypter application. When the application is launched, the very first thing it does is to read a single file of key material off the disk. It then immediately erases it by over writing. It does this no matter what happens next, so if you choose not to compose and send a message, you've lost that key material. Also if the application crashes or hits a snag, you've lost that key material. So it's one key file per encrypter invocation.

For the inward case, the decrypter application immediately over writes the key file that matches the inbound message IV (which serves as the filename). If you close the application, forget the message or it faults, you can't get the message back as the key material is gone.

If the user is willing to get on board with the usage protocol, it's the closest I can think of to a read once key store. The system relies on a modicum of user discipline and a hard disk full of material generated via your own trusted TRNG. A few thousand key files should last a while if you're using the OTP in an appropriate manner. And it does mimic a nitro-cellulose OTP booklet in that the operator would destroy the relevant page upon use, but the remaining pages could still fall into enemy hands.

This is clearly a (poor?) compromise but perhaps a little more practical than core storage. And of course it can't be used on non rotary media.

• Let me try to make a summary. You're describing an encryption protocol for sending messages, not storing them. The data is not destroyed but the OTP key stream is destroyed, regardless if the key stream gets to use the key stream stored on disk. You then explain that the user needs to keep a strict discipline to delete the OTP key stream. Is that a correct summary? If so, how does it describe a system where data is stored - not send and destroyed upon use? As it is the protocol seems to rely on "user discipline" to destroy any kind of information. – Maarten Bodewes Sep 23 at 10:54
• @MaartenBodewes No, not quite :-( It's a semi practical answer to the question behind the posted question. And within the operational context of a OTP user. It's very similar to the role of core storage and flash paper, both of which can be transferred and infinitely replicated elsewhere. The discipline is not to do so. If the user doesn't mess around and copy the key material off elsewhere, it self deletes on normal use/read. Seems to be what the question's about... – Paul Uszak Sep 23 at 12:42

There is a very practical way to do something essentially equivalent to storing a long one-time pad: store a 32-byte key $$k$$, and when you need a page of pad material, take the first 32 bytes of $$\operatorname{ChaCha}(k)$$ as a new key, replacing $$k$$ in memory, and the remaining bytes—up to about a zettabyte—as your pad.

Voilà! As long as you overwrite the key each time and never leave copies lying around elsewhere, you can extremely efficiently store more bytes of pad material than you can ever use this way, and nobody can ever recover old pads unless you made copies of them elsewhere.

This method is so practical that your computer is probably actually doing it—or a similar technique using AES—right now with the crypto.stackexchange.com web server!

• This doesn't really answer the "read only once" part – how would you force an adversary to actually do this instead of just reading the original key and reusing it several times? – Paŭlo Ebermann Sep 23 at 22:37
• A stream cipher is not essentially equivalent to a one-time pad. While for many purposes stream ciphers (such as the one you describe) are sufficient and people don't need one-time pads; whenever someone does need the specific advantages that a one-time pad provides, then this solution is not applicable as it does not provide them, it's substantially different from one-time pads, it's the same as most other "ordinary encryption". – Peteris Sep 23 at 23:33
• @PaŭloEbermann True. What my answer does is reduce the problem of erasing (say) gigabytes of data on first use to the problem of erasing (say) 32 bytes of data on first use, which may enable a considerably cheaper answer to the rest of the question—which isn't really a cryptography question, maybe more of a physics or electrical engineering question. – Squeamish Ossifrage Sep 24 at 0:42
• @Peteris The only role of the one-time pad in modern computing is a model for stream ciphers. Anyone who says differently is selling something. – Squeamish Ossifrage Sep 24 at 0:44
• @SqueamishOssifrage of course, the application of one-time pad is very niche because of the obvious impracticalities, but in the cases where you can implement a process for exchange of key material (point-to-point comms e.g. military submarines, embassies, etc) there's really no good reason to use something else; OTP is provably secure and there's a nonzero (though hopefully low) chance that NSA or someone like them can break ChaCha if they really want to. – Peteris Sep 24 at 1:11