Is this adaptation of using a One Time Pad safe?

Question

For example, lets say there are two people named, Bob, and Jim.

Bob wants to send Jim a long secret message, and he decides to use a OTP to encrypt his message. Both Bob and Jim know a secret password but it's only 8 character long, so they can't use this to encrypt the whole message. They are also unable to securely share a new key.

So Bob generates several random "child" keys, and then using their password as a seed for a CSPRNG he uses it to randomly select a series of characters from the "child" keys to form a new key, which he then uses to encrypt his message. Bob then sends the encrypted data with the "child" keys to Jim.

So, as long as Jim uses the same seed (their password) for the CSPRNG, the same sequence will be selected from the "child" keys, therefore giving him back the key that Bob used, which can then be used to decrypt the message.

Therefore, assuming an attacker has infinite computing power, he would soon realize that the message could be decrypted into a number of possible messages (just like the original OTP), and because he doesn't know what seed (password) was used for the CSPRNG, he'll never know for sure which message is the real one.

So, would this "adaptation" of the OTP actually work in the real world? What are the cryptographic weaknesses of using a OTP this way?

Answer 1

No, do not roll your own, this does not work and is much more insecure than any established and reliable cryptographic system. This is not a one time pad, it is an incredibly weak randomly generated password being used for a key derived pad, which is not a one time pad at all and has no more randomness (and quite possibly less) than the original key that was used as the seed value.

It would also be partially vulnerable to simple statistical analysis based on the % chance of a particular character getting chosen based on the frequency of value occurrence in the "child keys" which appear to only be getting used as a lookup table for a standard book cypher.

Answer 2

With OTP, always think about how secure the initial entropy is. Whatever the initial "seed" is, the security will equal that for OTP.

Generally speaking, anything that can be brute forced in less than 2^128 tries is generally considered insecure. (In other words there is a 50% chance of breaking something this secure in 2^64 tries)

To learn more about cryptography, I recommend looking at the cryptography class available at Coursera.

Answer 3

You only need two child keys: One with a random string of bits, and one with the inverse of that. Any more child keys would be redundant.

Next, using the CSPRNG to choose bits from either of those child keys is then equivalent of getting random bits from the CSPRNG and XORing them with one of the child keys. Since the child key is included in Bob's message to Jim, the child keys are also redundant.

So what are we essentially doing? We're using the 8-character password as a seed to generate the OTP. But this is a problem, because by doing so we've voided the warranty of OTP.

Cracking the OTP no longer produces every possible message, but only the small subset of every message that can be represented by an 8-character password. This subset is so small (e.g. 2^64 out of 2^8000 for a 1000-character message) that the cracker is guaranteed to get only one message that makes sense, and that is the original message we are trying to protect.

Since we now have none of the advantages of OTP and all of the disadvantages, I would recommend that Bob uses AES instead. And for goodness sake Bob, make a longer password next time!