1

I have read that in order for a one time pad to be truly secure, the pad itself must be random data. Given the practical difficulty of sharing a secure random pad, I was wondering what would be the problems with using the vast multitude of plain text documents that are currently available from the web.

For instance, if you had some prearranged pattern for selecting a document between Bob and Alice. Box uses one such document from the web, say a project Gutenberg file, and pads his message (UTF8) with that document and sends the encrypted file to Alice.

What process could Eve use to decrypt the message?

Assume that the pad is longer than the message, and that no other messages between Bob and Alice use the same pad, but other web documents that they mutually agreed upon.

Given the vast number of tracts of text this seems like it could be a practical source for one time pads. But I have a nagging suspicion that the basic language pattern in the pad could cause an issue.

5

Well, first of, the number of files in the project Gutenberg, though vast by human standards, is really small for a computer, so it is workable to simply try them all.

Apart from that remark, non-random pad data implies biases. If both the plaintext and the pad are "natural language texts", then the question becomes: given m XOR m', where both m and m' are "text", how can we recover m and m' ? This problem is equivalent to the infamous "two times pad", where a (truly) random pad p was used, but unfortunately twice, with two distinct messages m and m'. In the "two times pad" problem, the attacker knows m XOR p and m' XOR p; by XORing these two values together, the attacker obtains m XOR m' and proceeds from that. In your case, the encrypted text is already m XOR m', so the same attack method applies.

See this and that for details.

  • Thanks for the answer. On a side note I was using Project Gutenburg as only an example for all of the documents available on the web. – Walter Anderson Oct 28 '14 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.