Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
67 votes
Accepted

Are one-time pads crackable in theory?

For example, for a target bitstring of 100 bits, I cannot scan all bitstrings of 100 bits and XOR each with the target, hoping to recover the message. This approach will produce all messages that can ...
Maarten Bodewes's user avatar
  • 92.9k
42 votes
Accepted

Is one-time pad encryption vulnerable when near identical data is sent many times with different OTP?

No. As long as each pad is completely random and independent, you can encrypt literally anything of the appropriate size (no larger than the pad) and retain information theoretic secure ...
forest's user avatar
  • 15.3k
38 votes
Accepted

Why is OTP not vulnerable to brute-force attacks?

Brute force on OTP will give you all sorts of messages which are meaningful and not meaningful. For example, you have a 4-character encrypted text: weaw. Now brute-...
Abhisheietk's user avatar
27 votes

Is one-time pad encryption vulnerable when near identical data is sent many times with different OTP?

The short answer: No As long as the key is not reused, OTP has perfect secrecy. Even at some point if the attacker knows the plaintext, he will only get a key that is used once. A problem may occur ...
kelalaka's user avatar
  • 48.7k
25 votes

Are one-time pads crackable in theory?

To begin with, your definition of perfect secrecy is non-standard. The standard definition is given in an excellent answer to the question how is the OTP perfectly secure?. Essentially, perfect ...
kodlu's user avatar
  • 22.6k
22 votes

Why is OTP not vulnerable to brute-force attacks?

What you are missing is the fact that every resulting message is equally possible. There is no way to verify that any of the resulting messages was indeed the message that was sent. If you have $...
Maarten Bodewes's user avatar
  • 92.9k
22 votes

Is a PRG more costly than AES or any other encryption standard?

A one-time pad requires a true random sequence that is as long as the material you want to encrypt. If you have a pseudo-random sequence, then you don't have a one-time pad: you have a stream cipher. ...
Gilles 'SO- stop being evil''s user avatar
21 votes
Accepted

Why is mod calculation necessary in a one time pad encryption?

There are two main reasons. First, when we encrypt data with a symmetric algorithm, we generally want each unit to encrypt or decrypt to a unit of the same size (ignoring padding and MACs). In your ...
bk2204's user avatar
  • 3,466
21 votes

Is OTP still perfectly secure if we limit message and key space

Does that violate the perfect secrecy in any way? Yes, obviously. Restricting the message space doesn't hurt in any way (the attacker can't get any additional information about the message, even if ...
poncho's user avatar
  • 148k
19 votes

Why is mod calculation necessary in a one time pad encryption?

Not using modulus leaks information. For the English language, it's not so obvious. For an image, on the other hand... Left half uses addition and modulus, right half uses addition and division by ...
Fax's user avatar
  • 303
18 votes
Accepted

How were one-time pads and keys historically generated?

Your interesting questions deserve to be answered more thoroughly, but here goes: According to a highly classified document written in 1947 and finally declassified in 2013, the Germans started using ...
Patriot's user avatar
  • 3,132
17 votes

Does one time pad randomness help brute force attacks?

There is no such thing as a random key. There are only randomly generated keys. What I mean by that is that randomness is not a property of the key (or message, or number, or whatever), but of the ...
Ilmari Karonen's user avatar
17 votes

Is one-time pad encryption vulnerable when near identical data is sent many times with different OTP?

Why is OTP perfectly secure? Let's assume you would like to encrypt a plaintext $m$ using OTP. In order to do that, you would need to pick $m$ from a possible message space of $M$ with a given length....
MechMK1's user avatar
  • 445
16 votes

Why is OTP not vulnerable to brute-force attacks?

First you have to understand why it is possible to do exhaustive key searches on other systems. Suppose you have a plaintext of length n, ciphertext of the same ...
Steve Jessop's user avatar
15 votes
Accepted

Why would Carter-Wegman-style message authentication not be broken by P = NP?

While the one time pad seems obvious, I am not sure about Carter-Wegman-Style message auth. What they are talking about is a Carter-Wegman authentication method that uses a stream of random bits as ...
poncho's user avatar
  • 148k
15 votes
Accepted

One Time Pads and "Bit Flip" Attacks

accepted wisdom that OTP encrypted messages are secure & unbreakable OTP encrypted messages are secure & unbreakable assuming the pad is secret, uniformly random, and not reused... and the ...
fgrieu's user avatar
  • 142k
15 votes
Accepted

Can you use repeating numbers like $\pi$, and $e$, as the Key to OTP ciphers?

An OTP is completely broken if you use a key that can be predicted. As such, $\pi$ would be a terrible choice. The key needs to be unpredictable, nonrepeating, and completely random. $\pi$ satisfies ...
Serpent27's user avatar
  • 1,461
14 votes

Are one-time pads crackable in theory?

I'll try a practical example: I trade stocks. Instructions to my broker use a simple Caesar shift cipher, but the shift varies by values in a one-time encryption pad. Common 8-char instructions ...
Alan Campbell's user avatar
14 votes

Can one claim that AES has perfect secrecy for a key size and message size of 128 bits?

The answer is incorrect, but it's a bit more subtle than it seems. To make this clear, note that encrypting $x$ by computing $c=\operatorname{AES}_{0}(k) \oplus x$ would be perfectly secure (here the ...
Yehuda Lindell's user avatar
13 votes

Is Poly1305 an information-theoretically secure MAC?

Can the $AES_k(n)$ portion be simply replaced with $k \oplus n$? No, but you're close, it would be replaced with $k + n$, where $+$ is addition modulo $2^{128}$; then it becomes informational ...
poncho's user avatar
  • 148k
13 votes

One Time Pads and "Bit Flip" Attacks

There are different objectives when it comes to security. One objective is to make messages confidential. An OTP provides this in an information-theoretical secure way. Of course, the premise of OTP ...
Maarten Bodewes's user avatar
  • 92.9k
11 votes

Many time pad attack (XOR)

A character is usually encoded as an ASCII. This means that it uses up one byte. That's a number from $0 - 255$. It can be represented as a hexadecimal $\text{0x00} - \text{0xFF}$. All your operations ...
Filip Franik's user avatar
11 votes

Why use complex encryption algorithms?

We use more complex encryption algorithms than XOR with a random or pseudo-random keystream for a number of reasons: In order to get a short secret key in symmetric encryption. XOR with a true ...
fgrieu's user avatar
  • 142k
11 votes
Accepted

Is it possible to create a pseudo-One Time Pad by using a key smaller than the plaintext?

What you're proposing is called a stream cipher. Most stream ciphers take a key of one of a set of fixed sizes, usually with a non-secret value of fixed size called a nonce, and generate a very large ...
bk2204's user avatar
  • 3,466
10 votes
Accepted

If I am about to generate one-time pad, where should I generate my pads from?

/dev/urandom is only computationally secure, so you won't get information-theoretical security for your OTP if you draw it from ...
CodesInChaos's user avatar
  • 24.9k
10 votes

Is a PRG more costly than AES or any other encryption standard?

Distilling your question down to these two salient points:- Why don't we use OTP in every case, what is the downside? leads directly to Why wouldn't everyone encrypt with a One Time Pad? and I ...
Paul Uszak's user avatar
  • 15.5k
10 votes
Accepted

Doing OTP two or more times with a biased TRNG: Will this have the same security as if was done with a non-biased TRNG?

Better than using it once, but not as good as an unbiased TRNG. To see this, suppose our TRNG is very biased, producing a zero 10% of the time and an one 90% of the time. If we use the TRNG twice, for ...
Eugene Styer's user avatar
  • 1,676
9 votes
Accepted

What are the correct order of operations for One Time Pad Cipher?

There is no difference. In fact, any quasigroup operation will do. Specifically, the only property we really need is that, for every ciphertext symbol $C$ and every plaintext symbol $P$, there ...
Ilmari Karonen's user avatar
9 votes

OTP stream cipher

"Is it possible to actually obtain a key by XORING message(plaintext) and ciphertext?" Of course it is; it's actually pretty easy. On the other hand, those specific key bits were used once; their ...
poncho's user avatar
  • 148k
9 votes
Accepted

Can the same One-Time-Pad be re-used with some tricks

Based on comments it seems the question asks if this is as secure as OTP as opposed to finding a practical attack. It is clearly not as secure as OTP. It is not information thetorical secure. With ...
Meir Maor's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible