# What kind of encryption is a one-time pad?

Is it a substitution cipher or a stream cipher or both?

-
This sounds like homework .. hah :P – Chris Dale Jan 25 '11 at 8:46
Bruce Schneier memorizes his one time pads :) – naveen Feb 2 '11 at 16:22

It is not a substitution cipher. Schneier classifies it as a stream cipher because it converts plaintext to ciphertext one bit or byte at a time, generally by XORing the plaintext with a "keystream".

In most stream ciphers the keystream is only pseudo-random, but in a classic "one-time pad" the keystream is entirely random. It can be though of as a fresh key for each message, equal in length to the plaintext, which is typically combined with the plaintext via XOR so it is easy to get plaintext back from the ciphertext with another XOR. The trick is getting the pad itself - good quality truly random keying material - to the other end of the communications channel, out-of-band....

-

@nealmcb is correct that a one-time pad (OTP) is a stream cipher. However, he's not correct that the defining characteristic is the quality of the randomness. What defines an OTP is:

1. The key material is only used once
2. The key material is the same length as the plaintext

As with any other decent cipher, the quality of your key material is paramount. However, you can implement an OTP with not-very-random numbers -- it just reduces the security of the key.

### Edit

Based on the discussion below, clarification is in order.

A crypto algorithm is, strictly speaking, merely the mathematical definition of a set of cryptographic functions (encryption, decryption, and possibly signing). The definition of the algorithm may provide certain constraints, including allowable key lengths.

But choosing an algorithm is only one part of creating a secure cryptosystem. The others are:

1. Selecting an attack-resistant software or hardware implementation
2. Key management:
1. Generation
2. Distribution
3. Decommission
4. Retention
5. Revocation / Destruction

So to have a secure AES based cryptosystem, you need to have a good implementation of it, and good key management.

To have a secure OTP cryptosystem, you need to have sufficiently random keys, ensure they're only used once, and have a secure distribution system for them.

In either case, poor key management doesn't mean you're not using the specified algorithm.

-
Definitions can be pretty squirrelly things, but Schneier is pretty clear on the need for "truly random" numbers, which is why one-time pads are famous for being "perfectly secure" if the pad is kept a secret. Do you have a source for your definition, or a reason for allowing "not-very-random" numbers? – nealmcb Jan 26 '11 at 22:23
@Proteus, your answer is wrong. To qualify as a one-time pad, the key material must be uniformly random: i.e., if you are encrypting a single n-bit message, the key must be chosen uniformly at random from the set of all n-bit values. If you are generating your key via some not-very-random process, it no longer qualifies as a one-time pad (OTP). See Shannon's original paper on the subject. – D.W. Jan 27 '11 at 6:47
Just my tuppence worth - there are certain perfectly valid scenarios where using a truly random OTP would not be feasible. If you look at espionage you'll see where I'm coming from on this. Sometimes you need to use an OTP which must look innocuous - perhaps words/chars in a book or something else which an enemy may find. They would be suspicious of a table of random numbers, but may not notice a book. (I know - sounds a lot like security through obscurity - gah!) – Rory Alsop Feb 2 '11 at 10:27
This is getting silly, especially since my answer wasn't especially dogmatic about this point. I did go ahead and add "classic" to qualify my answer. But to be more specific about the Schneier source, it is Applied Cryptography, Second Edition, p 15: "Clasically, a one-time pad is nothing more than a large nonrepeating set of truly random key letters". And note that key management is hard mostly because of key distribution problems, not key generation, which is very algorithm-specific. Don't try RSA with just any old key.... – nealmcb Feb 2 '11 at 15:36
@rory Thanks for injecting a ray of practical perspective into the discussion. I'm no expert on espionage, but I would suggest at least that such spies not use text as a key for text since they share such a similar distribution and the ciphertext would be clearly identifiable and vulnerable. – nealmcb Feb 2 '11 at 16:14