I had a job interview yesterday where they asked what the only scenario where a one-time pad can be broken would be, my answer to which was "when the key distribution process is not secure enough".
They praised my answer, but they asked me another question: Why would you even use a one-time pad if the key distribution is 100% secure? Why not simply send the plain-text message since you are sure that distribution is 100% secure?
What is the correct answer to that question?
You can distribute the key now and send the message later.
Suppose you are a spy sent on a mission behind enemy lines. You take the key with you (secure distribution) and when you discover a secret you can securely send it using the One-Time pad.
That you can distribute something securely today, doesn't guarantee you can do it tomorrow - or next week or next year.
Also, your secure channel used to distribute the key may have limitations. Perhaps it depends on some person actually travelling between point A and B... Perhaps it's only available at certain times - e.g. weekends or during winter... Perhaps its capacity is very limited - maximum size per message and/or total messages that can be sent (e.g. it'll look suspicious if used too often with too much)... You may also want to "save" that channel for sending physical items (like OneTime-Pads or virus-samples), that actually can't be transmitted using radio or Internet - unlike text and images...
But the biggest obstacle is probably the time-aspect. Intelligence - the type spies gathers, and which are used in war and politics - has a very limited shelf-life. If you can't get the information out immediately, it looses its value - either because the slight head-start is gone, because whatever it warned about has happened, or because the same information trickles in from other sources.
So using the safe channels of communications - bringing it personally, couriers, letters past by officers on ship or planes, relaying the information through a chain of people - are probably all too slow. That leaves the fast - but unsafe and easily monitored - methods like radio, telegraph, telephone and the Internet. Through these insecure channels the information can be sent very quickly, but they're not safe... So you encrypt the information first, with the one-time pad you've gotten through the guaranteed secure channel.
And unlike your secure channel, it's almost 100% guaranteed that phones, radio and the Internet will be available also next year.
There are some practical scenarios, where you exchange a key and only know, that it was not intercepted (i.e. the exchange was 100% secure) after you sent it. If you would have directly transmitted the secret message, it could have been compromised, but since you only exchanged the key, you can just discard it. This is by the way the idea of quantum cryptography.
Another characteristics of quantum cryptography is, that you are not able to choose the key. It is just random and contains no information by itself. In fact you aren't even able to send any non random-generated information through the 100% secure quantum channel, which means you couldn't send your secret message directly. If you want to learn more about the subject I can recommend the Wikipedia page about Quantum key distribution.
The answers to the effect that secure distribution today doesn't ensure secure distribution tomorrow are ok, I guess, but isn't there another reason: distributing the keys is usually done from some central site to the "spies", whereas the spies are sending their messages in the reverse direction? (Assuming the spies are the ones generating the messages; of course messages can be sent in either direction.) Security in one direction does not necessarily imply security in the other direction.
An obvious case would be submarines sent out on missions. They're given one-time pads before they leave, but use those pads to encrypt messages they're sending back to base. (The base may be sending messages back to them, which of course gets back to the other answer: you don't want the submarines to have to come back to port to securely pick up messages from the base.)
It's a very good thing that the German Navy used Enigma, rather than one-time pads, in WWII.
I had a job interview yesterday where they asked what the only scenario where a one-time pad can be broken would be, my answer to which was "when the key distribution process is not secure enough".
I don't mean to give you insecurities about your interview, but I'm quite sure this is not the correct answer -- or, otherwise, I haven't understood your answer. This because your answer applies to any encryption method -- if you cannot communicate securely a symmetric key, then it's game over.
The only scenario in which a OTP can be broken (leaving aside obvious blunders from the communicating parties, such as reusing parts of the OTP, or letting the enemy get his hands over it) is when it has been generated using a non-truly random source. This would allow the enemy to run a frequency analysis and try to deduce the text being exchanged.
In fact, a one-time pad guarantees perfect security and is theoretically unbreakable. The only reasons why it is not being used widely is because of its impracticality.
Why would you even use a one-time pad if the key distribution is 100% secure? Why not simply send the plain-text message since you are sure that distribution is 100% secure?
The answer to this question is: because the secure channel could be not always available, could have a limited bandwidth, or could be too costly to use. So it can be used to exchange (once) a small-sized key but not (often) lengthy private communications.
Here's another reason that the other answers don't mention:
You can use your secure channel once to transmit OTPs and then send secure messages multiple times later until your OTPs run out.
This can be useful because achieving a 100% secure (or close to it) channel can be very difficult and/or costly, whereas insecure channels are cheap, fast, and readily available, so there is a benefit to minimising the frequency of your use of the secure channel.
Example: you transport 1 terabyte worth of OTP data by physically carrying a hard drive to the destination (a costly and inconvenient operation). You can then send 1 terabyte worth of encrypted messages via the internet as and when you need to. This is better than repeatedly using the secure channel to send your messages by hand.
A one-time pad can be broke if the message to be encrypted is significantly longer (like multiple times) than the number of characters/bytes in the pad. This amounts to repeated use of the same "one-time pad" and is equally vulnerable to decryption.
Honestly, I think a plausible answer is that you cannot guarantee 100% security. Or at least that would be my answer, likely followed by "anyone assuming 100% security does not understand security. Furthermore, anyone assuming 100% security is as much at risk, and possibly more, than someone assuming less than 100% security."
The question:
Why would you even use a one-time pad if the key distribution is 100% secure? Why not simply send the plain-text message since you are sure that distribution is 100% secure?
This assumes that at the time of the key distribution there is information to be sent which may not be the case. Other answers given here have addressed this point. Another issue is that even in principle the key distribution may only be good enough for only key distribution while it may be insecure for the desired transfer of information.
An example is the problem of how Edward Snowden can send you information securely. We assume that all communications from Snowden are monitored, if you meet him face to face then you'll be monitored, anything you take back from him won't be secure. So, there is then no way Snowden can give you a plain text file without that being compromised. At most you can bring something to Snowden securely. To implement the OTP method that's all you need to do.
A secure protocol using the OTP could then work as follows. I make copies of pictures I have on my hard disk and put them on a thumb drive. I ask someone who I trust to give this thumb drive to Snowden. After this person has met with Snowden, he is spotted having done so, all his belongs are searched, the CIA monitors him, his house ends up burgled regularly, spyware in installed on his computer. So, obviously he cannot receive anything from Snowden securely.
But Snowden can send information to me securely by applying the OTP method to split up messages into two white noise parts and adding that noise as fake high ISO noise to two pictures that he obtained from me and uploading these two pictures to Flickr. All I have to do is download his latest two Flickr postings, subtract the picture files from the pictures on my hard drive and add up the two noise parts to obtain the message.
If you send really confident text that can't be intercepted by computers under any circumstances, then you should use OTP and deliver key face-to-face, but you can mail encrypted message via post office. If used properly, then anyone can't break messages. Even in 1'028'526'910 year.
