5

There are two paths in hardware that would be possible without doing something exotic. Erase the actual bits. Blow the bank. Erase: When I make analog floating-gates, I use classical physics to program them (put charge on the gate) and a quantum effect of tunneling to pull charge off (make the gate positive). I could tunnel and read concurrently which ...


4

Practically speaking, I think that - in the realm of cryptography - a HSM is the closest that you can get. A HSM is a tamper-proof box that destructs or disables the keys and data stored within it when it detects distortion. Of course a HSM is a practical device; it doesn't provide information theoretic certainty that the information will be destroyed. ...


4

First, let's re-iterate that there is no true one-time pad in modern cryptography or any other information system - it's only a hypothetical thinking reference. The reason to use OTP in this case, would be to maximize the utility of the rare window where there would be a secure channel. Let's imagine a world without internet and public-key cryptography ...


4

Why don't most encryption algorithms use perfect secrecy? Perfect secrecy can only achievable if the $\text{key size} \geq \text{message size}$ and the key is never re-used. It is not suitable for modern usage, where a lot of messages are sent/received and that is impractical since one has to send the key beforehand in a secure channel and this is not ...


3

How many non-trivial*, interesting perfect secrecy systems are there other than the one-time-pad? Infinitely many. Let $\mathbb G$ be a group (written multiplicatively). Then $\operatorname{KeyGen}(1^n)=k\stackrel{\$}{\gets}\mathbb G^n$, that is the key is a vector of $n$ independently random group elements. $\operatorname{Enc}(k,m):\mathbb G^n\times \...


3

Any group operation works for a one-time-pad if you can shoehorn a message uniquely into a group element—addition modulo $n$, multiplication modulo $n$ if you can uniquely encode a message block as an integer coprime with $n$, addition or multiplication in finite extension fields, invertible matrix multiplication over finite fields, whatever group you want—...


2

As far as I know OTP is the only algorithm proven to provide perfect secrecy. Naah, there are others. For example, you can do Shamir secret sharing, have the key be one of the shares, and broadcast the other $N-1$ shares. That also has perfect secrecy - it also doesn't have any specific advantages over OTP, so we never consider bothering. What other ...


2

The Gilbert-MacWilliams-Sloane MAC referred to by @SqueamishOssifrage in the comments is information theoretically secure "for single use", at the cost of having hashes that have length $2\ell$ for fixed length messages of length $\ell.$ Poly1305 is not information theoretically secure. It is much more flexible, can take essentially arbitrary length inputs,...


2

This is a standard concept in cryptography, and it is called a stream cipher. It doesn't give ‘perfect’ secrecy, which is a red herring, but it is the modern standard for how to do cryptography—for example, your web browser is almost certainly using exactly this principle right now to talk to the crypto.stackexchange.com web server, using either AES-GCM or ...


2

Ferroelectric RAM is a modern analog to magnetic core memory, from the standpoint that reading it looses the information previously stored (source). Usually there is on-die write-after-read circuitry to prevent information loss (much like that was built in core memory controllers). If that circuitry was removed we'd get a read-once memory. On the other hand,...


2

Because the one-time pad allows you to send a confidential message over an (otherwise) insecure channel at a later time than when you send the key over the requisite secure channel. And at that later time you may not have access to that secure channel. One way to put it is this: most cryptography requires you to use some sort of out of band secure channel ...


1

If I understand correctly, your input to HMAC is the ciphertext $c$, padded with null bytes (to a multiple of 16 bytes): # pad to a multiple of 16 bytes if self._len_ct & 0x0F: self._auth.update(bytes(16 - (self._len_ct & 0x0F))) As a concrete example, suppose the ciphertext is $c=$ deadbeef00, then you will compute the HMAC tag as $t ...


1

It is helpful to first define what a perfectly secure block cipher is. In the ideal case there are n different keys where each key uniquitely indexes one of the permutations mapping {0,1}^k to {0,1}^k. In this case we have n=(2^k)! Possible permutations/keys. Perfect security typically means that no information is revealed at all. Not even against an ...


1

So there is already PFS in phase I by design. Each time someone establishes a new IPsec VPN tunnel, a new DH shared secret g^xy will be used to compute SKEYID_d, right? Hence, the session key in phase II will also be unique. This is PFS right there? No, you do not recompute a fresh SKEYID_d for every Quick Mode; instead, a value for SKEYID_d is assigned ...


1

You use a secure communication channel to share the key. This is where my brains stop working. Good, your good skeptic brain should at least pause at this point to form a question. Preferably it should start working again and try and get an answer, e.g. from this site :) Why share the key of a OTP through a secure channel, and not just share the ...


1

There is a very practical way to do something essentially equivalent to storing a long one-time pad: store a 32-byte key $k$, and when you need a page of pad material, take the first 32 bytes of $\operatorname{ChaCha}(k)$ as a new key, replacing $k$ in memory, and the remaining bytes—up to about a zettabyte—as your pad. Voilà! As long as you overwrite the ...


1

how does that violate the definition (1) ? Let's assume $|K|<|M|$. Then there exist $c\in C$ and $m\in M$ such that for all $k\in K$, you cannot get $c=E_k(m)$ ($c$ encrypts $m$ under the key $k$). Now expand the conditional probability of your definition (1): $$\Pr[M=m|C=c]=\frac{\Pr[M=m\;\&\;C=c]}{\Pr[C=c]}$$ but since $|K|<|M|$, we already ...


1

However, since most books define the keyspace $\mathcal{K}$ to be finite, then with infinite time any computational device can perform an exhaustive keysearch. The thing is that it isn't sufficient to perform an exhaustive key search. You must also have a procedure to evaluate the candidate decryptions that the key search produces and judge which ones are ...


Only top voted, non community-wiki answers of a minimum length are eligible