One-time pad is a method where you XOR plaintext with the key. If the key is be random and not used more than one then the one-time pad is unbreakable. Another advantage is easy implementation. Typically good encryption methods are very hard to implement and hence due to errors in implementation, often not very secure. A XOR B could be an exercise in Programming 101.

The problem with one-time pad is to generate random keys and deliver them securely.

However, there are a lot of cases where the secure delivery of the key is not a problem. A ship, for instance, when on home port, one can simply walk in with the key in hand. Later, when on sea/in another port, the key can used for 100% unbreakable communications.

Another example could be an embassy: a new ambassador can personally carry the key with him. Then the embassy could use it to encrypt sensitive messages and deliver over any channel.

The required length of the key is often quoted as a problem, but is it really? A modern hard-disk has a capacity of 1000 GB. That is enough to encrypt one 1KB message per second for over 2500 years. It fits into a pocket. Costs less than 100 USD.

Generating a truly random key is not too hard, you can simply observe a random natural process, such as radioactive decay or background noise on the atmosphere and use that to generate key.

So it seems that at least in some cases the impracticalities of One-Time Pad can be solved fairly easily.

Is One-Time Pad really not used anywhere?

  • 4
    Who says it's not used anywhere? (Bonus question: what's so good about 100% unbreakable communications?) Dec 21, 2015 at 13:06
  • I am pretty positive that the famous "red phone" in the white house used it, at least during the cold war for the moscow-washington hotline. I would think that similar high security communication could use the same principle.
    – John
    Dec 21, 2015 at 13:19
  • Distribution is still a problem. You need a key for each direction. For instance, what happens if Embassy A wants to send a message to Embassy B? You'd need a set of keys just for them (since you might not want Embassy C to listen in). Much easier to just give everybody a private key. There are procedure problems with things like timing of messages, given you have to know where each message started, and how long it was (so either you observe a strict receive order, or you need to add that info, unencrypted, which gives more info to an attacker). Dec 21, 2015 at 13:20
  • @Clockwork-Muse such systems using otp would likely have a dedicated communications channel not running through the internet. If it is a high profile operation the persons would meet and exchange the keys face to face. It surely isn't practical for everyday business, but for extrem secrecy. The question is whether it actually gives any benefit and if it is still used. The latter can't be answered as I doubt that any government publicly announces what they use.
    – John
    Dec 21, 2015 at 13:25
  • I've heard rumours that spies get OTP keys "face-to-face" and then receive a broadcast which is just random nonsense to anyone without that OTP key. This also allows the spies to decode instructions by hand as they use a variation of the OTP.
    – SEJPM
    Dec 21, 2015 at 14:42

2 Answers 2


After some research it appears you are correct in your deduction that one-time pads are possible to use. There is just a minor problem of generating truly random keys and distributing them to whoever needs to send and receive messages. For a True RNG you can buy various hardware devices, or you can make your own or you can simply extract true random data from things like your sound card or digital camera. For key exchange this is as simple as putting all the key material on portable storage e.g. SD card or CD and walking it over to the person you want to talk to.

One-time pads may not be very popular for commercial systems, however but these mass market products are generally not protecting things of critical importance. One-time pads have been used for very critical communications in history, most notably SIGSALY[1] which protected the highest level of voice communications between the Allies in WWII and the Washington-Moscow hotline[2] which connected the leaders of Russia and the US. They are still used for keeping the most sensitive US government communications secret. For this they use heavily armoured trucks, protected by armed guards to transport random numbers between the Pentagon and remote locations[3].

Quantum Key Distribution systems are also becoming more manageable but for now it seems they only work on short distances e.g. 100 KM. That would work for linking remote locations together. These systems use the quantum channel to exchange the one-time pad key material securely in one direction and can detect interception. Once the key material has been sent securely to the other side then they can both use the regular internet to send the encrypted data which is protected by the one-time pad encryption and an information-theoretically secure MAC. There are a number of commercial providers offering this type of service[4] however some just use regular AES for the encryption.

From my readings it appears one-time pads have a lot of negative connotations and even Bruce Schneier in 1999 had been casting blanket aspersions on them[5] as "snake oil cryptography", mainly because of a few unscrupulous companies advertising that they were using "unbreakable one-time pad cryptography" when actually they were not. That's likely a fair assessment for these particular companies because they can't actually prove they have an unbreakable product, mainly because their product is closed source (unverifiable) and there's no technical details about the design. They could be just using a stream cipher or weaker construction for all we know.

However I disagree with Schneier's general assertion that all one-time pad systems are snake oil. The US, UK and Russian governments have used them in the past and still do use them for certain important communications. So if it has been proven to work in critical government/military networks then that's clear proof it's not snake oil. Some smart people in those governments have obviously figured out a way to make it work properly for them. I agree on his point that they make less sense for a mass market encryption protocol like TLS. However for personal uses, one-time pads could still work for small groups of users wishing to have long term security for the confidentiality of their messages.

In truth there is no public key or symmetric key system which has provable guarantees that its algorithm will hold up to the test of time and 100+ years of cryptanalysis. The NSA are collecting and storing everything right now. Also most of the current encryption protocols will be broken by quantum computers[6] when they arrive. So if you encrypt with current public key systems like RSA and elliptic curves now you have to be very careful about what exactly you encrypt or say in your messages. A totalitarian government of the future may eventually retroactively decrypt your messages and lock you away for something as benign as your taste in music[7].

I found a couple of open source research/prototype projects which aim to do one-time pads properly. I think these also dispel the myth that all one-time pad systems are snake oil. Like everything in life, nothing is completely perfect but I think these are a step in the right direction. It will take some time to get other cryptographers to review the designs of these projects and refine them so they are fully secure and trusted. They are however an interesting proof of concept for now. I have listed them below:

Tinfoil Chat OTP: This is a nice software and hardware solution. As well as information-theoretic security it also aims to provide protection against automated targeted attacks practiced by the NSA, GCHQ etc. This would be quite secure in theory against attacks to steal the encryption keys from the client devices and also protect against side channel attacks. The downside is you would need to build the specialised hardware required.

Jericho Comms: This is a pure software based one-time pad solution which helps with managing the key generation, key management and allows for group text chat as well. You would need to take care to properly secure the underlying stack first e.g. by running an open source OS such as Linux/Unix, then using full disk encryption and firewalls etc on the client machines. I think it could get up and running in a few hours however and not require specialised hardware.

  • [1] en.wikipedia.org/wiki/SIGSALY

  • [2] en.wikipedia.org/wiki/Moscow%E2%80%93Washington_hotline#Encryption

  • [3] bu.edu/ece/tag/one-time-pad/

  • [4] technologyreview.com/view/514581/government-lab-reveals-quantum-internet-operated-continuously-for-over-two-years/

  • [5] schneier.com/crypto-gram/archives/1999/0215.html#snakeoil

  • [6] youtube.com/watch?v=6XeBvdm8vao

  • [7] theguardian.com/australia-news/2015/sep/25/radicalisation-kit-links-activism-and-alternative-music-scene-to-extremism

  • Thank you, very good answer. Using camera images as a truly random source was new to me. However, I would think that for any real use a specialised hardware would be a better option. Jan 6, 2016 at 9:31
  • One time pads are actually super simple to implement if your users can implement the security requirements. You can even "make" users implement the security requirements with some tricks. They will of course be ways around it, but in cryptography you only need to assume the adversary knows the system, not the users.
    – PyRulez
    Feb 14, 2019 at 23:24

The one time pad has been used in several crypto-systems as well as authentication for the very reasons you're describing.

It was used for the highest level radio voice communication between the allies during WWII in a system called Sigsaly, designed by no less than Alan Turing. It was also used (and possibly still is) during the cold war to send telegrams between the US and Soviet Union, primarily because neither side wanted to reveal their best crypto to the other. One time pads are currently used by the yubikey authentication scheme.

  • 3
    Re YubiKey: I think you're mixing up one time pad and one time password. Dec 21, 2015 at 16:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .