66
votes
Accepted
Are one-time pads crackable in theory?
For example, for a target bitstring of 100 bits, I cannot scan all bitstrings of 100 bits and XOR each with the target, hoping to recover the message. This approach will produce all messages that can ...
- 91.7k
42
votes
Accepted
Is one-time pad encryption vulnerable when near identical data is sent many times with different OTP?
No. As long as each pad is completely random and independent, you can encrypt literally anything of the appropriate size (no larger than the pad) and retain information theoretic secure ...
- 15.1k
37
votes
Accepted
Why is OTP not vulnerable to brute-force attacks?
Brute force on OTP will give you all sorts of messages which are meaningful and not meaningful.
For example, you have a 4-character encrypted text: weaw. Now brute-...
- 486
27
votes
Is one-time pad encryption vulnerable when near identical data is sent many times with different OTP?
The short answer: No
As long as the key is not reused, OTP has perfect secrecy. Even at some point if the attacker knows the plaintext, he will only get a key that is used once. A problem may occur ...
- 47.6k
24
votes
Are one-time pads crackable in theory?
To begin with, your definition of perfect secrecy is non-standard. The standard definition is given in an excellent answer to the question how is the OTP perfectly secure?.
Essentially, perfect ...
- 21.2k
23
votes
Accepted
How is the One Time Pad (OTP) perfectly secure?
You've actually been trapped by the mindset that OTP will hide all information about the underlying plaintext.
This is not true as you have observed.
The definition of perfect secrecy, given in ...
- 45.7k
22
votes
Why is OTP not vulnerable to brute-force attacks?
What you are missing is the fact that every resulting message is equally possible. There is no way to verify that any of the resulting messages was indeed the message that was sent.
If you have $...
- 91.7k
22
votes
Is a PRG more costly than AES or any other encryption standard?
A one-time pad requires a true random sequence that is as long as the material you want to encrypt. If you have a pseudo-random sequence, then you don't have a one-time pad: you have a stream cipher. ...
21
votes
Accepted
Why is mod calculation necessary in a one time pad encryption?
There are two main reasons.
First, when we encrypt data with a symmetric algorithm, we generally want each unit to encrypt or decrypt to a unit of the same size (ignoring padding and MACs). In your ...
- 2,971
21
votes
Is OTP still perfectly secure if we limit message and key space
Does that violate the perfect secrecy in any way?
Yes, obviously. Restricting the message space doesn't hurt in any way (the attacker can't get any additional information about the message, even if ...
- 145k
19
votes
Why is mod calculation necessary in a one time pad encryption?
Not using modulus leaks information.
For the English language, it's not so obvious. For an image, on the other hand...
Left half uses addition and modulus, right half uses addition and division by ...
- 303
18
votes
Accepted
How were one-time pads and keys historically generated?
Your interesting questions deserve to be answered more thoroughly, but here goes:
According to a highly classified document written in 1947 and finally declassified in 2013, the Germans started using ...
- 3,102
17
votes
Does one time pad randomness help brute force attacks?
There is no such thing as a random key. There are only randomly generated keys.
What I mean by that is that randomness is not a property of the key (or message, or number, or whatever), but of the ...
- 45.9k
17
votes
Is one-time pad encryption vulnerable when near identical data is sent many times with different OTP?
Why is OTP perfectly secure?
Let's assume you would like to encrypt a plaintext $m$ using OTP. In order to do that, you would need to pick $m$ from a possible message space of $M$ with a given length....
- 445
16
votes
Why is OTP not vulnerable to brute-force attacks?
First you have to understand why it is possible to do exhaustive key searches on other systems.
Suppose you have a plaintext of length n, ciphertext of the same ...
- 261
15
votes
Accepted
Why would Carter-Wegman-style message authentication not be broken by P = NP?
While the one time pad seems obvious, I am not sure about Carter-Wegman-Style message auth.
What they are talking about is a Carter-Wegman authentication method that uses a stream of random bits as ...
- 145k
15
votes
Accepted
One Time Pads and "Bit Flip" Attacks
accepted wisdom that OTP encrypted messages are secure & unbreakable
OTP encrypted messages are secure & unbreakable assuming the pad is secret, uniformly random, and not reused... and the ...
- 138k
15
votes
Accepted
Can you use repeating numbers like $\pi$, and $e$, as the Key to OTP ciphers?
An OTP is completely broken if you use a key that can be predicted. As such, $\pi$ would be a terrible choice. The key needs to be unpredictable, nonrepeating, and completely random. $\pi$ satisfies ...
- 1,441
14
votes
Can one claim that AES has perfect secrecy for a key size and message size of 128 bits?
The answer is incorrect, but it's a bit more subtle than it seems. To make this clear, note that encrypting $x$ by computing $c=\operatorname{AES}_{0}(k) \oplus x$ would be perfectly secure (here the ...
- 27.6k
13
votes
Are one-time pads crackable in theory?
I'll try a practical example:
I trade stocks. Instructions to my broker use a simple Caesar shift cipher, but the shift varies by values in a one-time encryption pad. Common 8-char instructions ...
- 231
13
votes
Is Poly1305 an information-theoretically secure MAC?
Can the $AES_k(n)$ portion be simply replaced with $k \oplus n$?
No, but you're close, it would be replaced with $k + n$, where $+$ is addition modulo $2^{128}$; then it becomes informational ...
- 145k
13
votes
One Time Pads and "Bit Flip" Attacks
There are different objectives when it comes to security. One objective is to make messages confidential. An OTP provides this in an information-theoretical secure way. Of course, the premise of OTP ...
- 91.7k
11
votes
How is the One Time Pad (OTP) perfectly secure?
You stated:
"I can at the very least narrow down the list of possibilities."
Here's an example of why OTP is perfect secrecy, and why your statement, although true, doesn't matter.
I have a ...
- 221
11
votes
How is the One Time Pad (OTP) perfectly secure?
What you propose is equivalent to trying to do cryptanalysis without any cipher text or other material.
Equivalently, you could just take the small plaintext seed that you know, and nothing else, and ...
- 211
11
votes
Many time pad attack (XOR)
A character is usually encoded as an ASCII. This means that it uses up one byte. That's a number from $0 - 255$. It can be represented as a hexadecimal $\text{0x00} - \text{0xFF}$. All your operations ...
- 677
11
votes
Why use complex encryption algorithms?
We use more complex encryption algorithms than XOR with a random or pseudo-random keystream for a number of reasons:
In order to get a short secret key in symmetric encryption. XOR with a true ...
- 138k
11
votes
Accepted
Is it possible to create a pseudo-One Time Pad by using a key smaller than the plaintext?
What you're proposing is called a stream cipher. Most stream ciphers take a key of one of a set of fixed sizes, usually with a non-secret value of fixed size called a nonce, and generate a very large ...
- 2,971
10
votes
How does one attack a two-time pad (i.e. one time pad with key reuse)?
I just came across this question and was surprised that no one referenced the paper: A Natural Language Approach to Automated Cryptanalysis of Two-time Pads by Mason et al. at ACM CCS 2006. This shows ...
- 27.6k
10
votes
Accepted
If I am about to generate one-time pad, where should I generate my pads from?
/dev/urandom is only computationally secure, so you won't get information-theoretical security for your OTP if you draw it from ...
- 24.8k
10
votes
Is a PRG more costly than AES or any other encryption standard?
Distilling your question down to these two salient points:-
Why don't we use OTP in every case, what is the downside?
leads directly to Why wouldn't everyone encrypt with a One Time Pad? and I ...
- 15.1k
Only top scored, non community-wiki answers of a minimum length are eligible