Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

Is it a substitution cipher or a stream cipher or both?

share|improve this question
1  
This sounds like homework .. hah :P – Chris Andrè Dale Jan 25 '11 at 8:46
Bruce Schneier memorizes his one time pads :) – yetanothercoder Feb 2 '11 at 16:22

2 Answers

up vote 16 down vote

It is not a substitution cipher. Schneier classifies it as a stream cipher because it converts plaintext to ciphertext one bit or byte at a time, generally by XORing the plaintext with a "keystream".

In most stream ciphers the keystream is only pseudo-random, but in a classic "one-time pad" the keystream is entirely random. It can be though of as a fresh key for each message, equal in length to the plaintext, which is typically combined with the plaintext via XOR so it is easy to get plaintext back from the ciphertext with another XOR. The trick is getting the pad itself - good quality truly random keying material - to the other end of the communications channel, out-of-band....

See also One-time pad - Wikipedia, the free encyclopedia

share|improve this answer
up vote 0 down vote

@nealmcb is correct that a one-time pad (OTP) is a stream cipher. However, he's not correct that the defining characteristic is the quality of the randomness. What defines an OTP is:

  1. The key material is only used once
  2. The key material is the same length as the plaintext

As with any other decent cipher, the quality of your key material is paramount. However, you can implement an OTP with not-very-random numbers -- it just reduces the security of the key.

Edit

Based on the discussion below, clarification is in order.

A crypto algorithm is, strictly speaking, merely the mathematical definition of a set of cryptographic functions (encryption, decryption, and possibly signing). The definition of the algorithm may provide certain constraints, including allowable key lengths.

But choosing an algorithm is only one part of creating a secure cryptosystem. The others are:

  1. Selecting an attack-resistant software or hardware implementation
  2. Key management:
    1. Generation
    2. Distribution
    3. Decommission
    4. Retention
    5. Revocation / Destruction

So to have a secure AES based cryptosystem, you need to have a good implementation of it, and good key management.

To have a secure OTP cryptosystem, you need to have sufficiently random keys, ensure they're only used once, and have a secure distribution system for them.

In either case, poor key management doesn't mean you're not using the specified algorithm.

share|improve this answer
1  
Definitions can be pretty squirrelly things, but Schneier is pretty clear on the need for "truly random" numbers, which is why one-time pads are famous for being "perfectly secure" if the pad is kept a secret. Do you have a source for your definition, or a reason for allowing "not-very-random" numbers? – nealmcb Jan 26 '11 at 22:23
1  
@Proteus, your answer is wrong. To qualify as a one-time pad, the key material must be uniformly random: i.e., if you are encrypting a single n-bit message, the key must be chosen uniformly at random from the set of all n-bit values. If you are generating your key via some not-very-random process, it no longer qualifies as a one-time pad (OTP). See Shannon's original paper on the subject. – D.W. Jan 27 '11 at 6:47
@D.W., you're conflating "what's a one-time-pad" with "what's a secure one-time-pad". OTPs have been around a long time, and can be implemented insecurely with non-random key material, just as any cipher can be used with insecure keys. If you're generating your OTP key material with non-random keys, it's insecure, but as long as you never use that key again it is technically an OTP. – Proteus Feb 1 '11 at 0:32
1  
Just my tuppence worth - there are certain perfectly valid scenarios where using a truly random OTP would not be feasible. If you look at espionage you'll see where I'm coming from on this. Sometimes you need to use an OTP which must look innocuous - perhaps words/chars in a book or something else which an enemy may find. They would be suspicious of a table of random numbers, but may not notice a book. (I know - sounds a lot like security through obscurity - gah!) – Rory Alsop♦ Feb 2 '11 at 10:27
1  
@rory Thanks for injecting a ray of practical perspective into the discussion. I'm no expert on espionage, but I would suggest at least that such spies not use text as a key for text since they share such a similar distribution and the ciphertext would be clearly identifiable and vulnerable. – nealmcb Feb 2 '11 at 16:14
show 9 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.