Let's say I have some sensitive information, and I want to encrypt it with a OTP and send it to the FBI or something. Now, in order for the recipient to successfully decrypt the message, he needs to know the OTP key as well. But, you don't just send the key as plain text to the recipient, this is fairly obvious since an adversary can obtain it with ease. So then what? You use a secure communication channel to share the key. This is where my brains stop working. Why share the key of a OTP through a secure channel, and not just share the sensitive information itself through that secure channel?
First, let's re-iterate that there is no true one-time pad in modern cryptography or any other information system - it's only a hypothetical thinking reference.
The reason to use OTP in this case, would be to maximize the utility of the rare window where there would be a secure channel.
Let's imagine a world without internet and public-key cryptography cannot be carried out efficiently by any instrument available to the people and the enemy, the secure channel is a scarce resource, so a huge OTP stream is exchanged here so that it may be used later over the radio, possibly chunked according to the size of messages.
This way, the time to exchange the actual (encrypted) message can be freely chosen.
Because the one-time pad allows you to send a confidential message over an (otherwise) insecure channel at a later time than when you send the key over the requisite secure channel. And at that later time you may not have access to that secure channel.
One way to put it is this: most cryptography requires you to use some sort of out of band secure channel whose security is not achieved through cryptographic means. The trick is that different types of cryptography allow us to reduce our use of such channels and weaken our requirements of them:
- One-time pads require a confidential and authentic channel (one that resists eavesdropping, impersonation and forgery) to exchange the lengthy keys, but that channel can have tighter availability constraints than the regular channel (e.g., it might only be available intermittently at special physical locations).
- Computationally secure symmetric cryptography also prima-facie requires a confidential and authentic channel to establish shared secret keys, but it minimizes the use of such channels. While in OTP the volume of data that you can encrypt cannot exceed the volume of key material you previously established over the prerequisite secure channel, in computationally secure symmetric cryptography it can grow far past; small amounts of key material allow you to protect astronomical volumes of data.
- Asymmetric cryptography allows the use of non-confidential channels (that allow eavesdropping) for key establishment, but still requires that such channels guarantee authenticity (they must disallow impersonation, forgery or man-in-the-middle). I.e., you need to know that you have your intended counterparty's authentic public key, but you can establish that for example by meeting them in a public location, or by using a public key infrastructure (PKI) whose root certificates are publicly disseminated and auditable.
You use a secure communication channel to share the key. This is where my brains stop working.
Good, your good skeptic brain should at least pause at this point to form a question. Preferably it should start working again and try and get an answer, e.g. from this site :)
Why share the key of a OTP through a secure channel, and not just share the sensitive information itself through that secure channel?
If you assume that the secure channel can be listened to then this is not a true OTP anymore. The key stream is not communicated using a perfectly secure channel. Instead the key is established using the transport mode as key establishment routine. And therefore the OTP is downgraded to that level of security. Given the track record of transport security, that might be anywhere between non-existent and relatively secure.
Now there are things that would help you obtain security. For instance, you could share the key at a time that you suppose that the attacker isn't listening. If you do that then an attacker will find it impossible to decrypt anything send using the OTP afterwards.
However, whichever way you spin this, adding requirements like "the adversary is simply not listening" is adding assumptions to the system. And since assumption is the mother of all fuckups, you can be 100% certain that the result is not "perfectly secure".
(Your tags contain "forward secrecy" or "perfect forward secrecy". That's the worst term in cryptography, because it does not mean what you think it may mean. "Perfect" only means that one message is not dependent on the security of other sessions. It doesn't mean that the protocol or algorithms cannot be broken. The term is already better when "perfect" is left out of it.
Similarly, "forward secrecy" only means that the keys become unavailable at the location of the sender / receiver. They can however still be found if e.g. the DH cryptosystem is broken. It does not equal perfect secrecy in the way that OTP does. So it has no place this discussion, it just provides a limited extra amount of security for the transport layer)
There is simply no 100% secure way of distributing keys. Not even quantum key distribution can achieve that, because it still relies on real world setups. And that's where the theoretical security of OTP breaks down. (A similar argument could be made when it comes to generating a "perfectly random" key in the first place).
An advantage of the OTP construction is that once you have established the key stream securely, the resulting cipher is as secure as the previous establishment. However, the cipher itself is extremely simple and doesn't contain any overhead. You can therefore obtain confidentiality of your messages even if you only limited communication and computation capabilities.
If that's enough of an advantage remains to be seen. The lack of message integrity & authentication would be a serious drawback to any reliable communication. It might be beneficial to older systems where the OTP has already been established.