Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
161

You can distribute the key now and send the message later. Suppose you are a spy sent on a mission behind enemy lines. You take the key with you (secure distribution) and when you discover a secret you can securely send it using the One-Time pad.


84

Key distribution is the problem. In your scenario, you use a server to communicate the one-time pads to the users. But how is that communication protected? Not by a one-time pad, or it wouldn't be necessary. Let's say it's SSL with AES 128. Then, wham, your cryptosystem is as secure as SSL with AES 128 - pretty secure, but not as secure as a one-time ...


50

That you can distribute something securely today, doesn't guarantee you can do it tomorrow - or next week or next year. Also, your secure channel used to distribute the key may have limitations. Perhaps it depends on some person actually travelling between point A and B... Perhaps it's only available at certain times - e.g. weekends or during winter... ...


31

No, because you misunderstand the meaning of "best" in a security context. Contrary to popular opinion, "most secure" and "best" are not synonyms, rather, security is entirely about balancing usability and security. It is about risk management. The most secure drive on the planet is writing to DevNull (the bit bucket) on the bottom of the ocean in a ...


30

There are some practical scenarios, where you exchange a key and only know, that it was not intercepted (i.e. the exchange was 100% secure) after you sent it. If you would have directly transmitted the secret message, it could have been compromised, but since you only exchanged the key, you can just discard it. This is by the way the idea of quantum ...


29

No. Not only does a one time pad suffer from secure key distribution problems Mike and gowenfawr mentioned in their answers but: Even if if you did have a mechanism to securely distribute keys, the one time pad (by itself) has no mechanism for ensuring integrity. The ciphertext is what we call "malleable" meaning that it can be manipulated by an ...


28

The problem with a one time pad, is that is must be equal in length (or longer) than the data being encrypted , and must never, ever, be reused. Just as you indicate, how would they send the key?, the OTP must then be sent in a secure way... however that is the problem that is usually left to the user and is generally why OTP is useless. If you have the ...


19

How would they pass they key? This gets to the root of where OTPs came from, and indeed how they got that name. This is for correspondence during wartime with ships or other similar agents[*]. When the ship leaves port, they head out with a pad of random data. When they receive an encrypted communication over the radio, they decode it using the indicated ...


12

Not really "Internet", but the one-time pad is documented to have been used for the Red Phone (a westernly-biased name; I don't know how they called it in Moscow). The pads were exchanged on magnetic tapes, sent by planes on a weekly basis. It is possible that the current system still uses a similar encryption method. This makes sense: though the one-time ...


10

The answers to the effect that secure distribution today doesn't ensure secure distribution tomorrow are ok, I guess, but isn't there another reason: distributing the keys is usually done from some central site to the "spies", whereas the spies are sending their messages in the reverse direction? (Assuming the spies are the ones generating the messages; of ...


8

No one uses One-time pads, because it is impractical. Modern cryptography utilizes block ciphers and stream ciphers because all you need to do is transmit a very small key, using a key exchange method and then based on this key you can generate an effectively infinite amount of pseudo-random output. A stream cipher works a lot like a one time pad. If ...


8

It is a matter of redundancy of information. An attacker wants to decrypt some piece of data, because he is interested in that data, and thus has context information. For instance, assuming a HTTPS connection, the attacker knows that what is encrypted is an HTTP request and an HTTP response, both coming with syntactically correct HTTP headers. It is highly ...


8

You are trying to compare a Cryptographic Primitive and compare it to Cryptographic system. This is really comparing apples and oranges. Cryptographic Primitives are put together to create a Cryptographic system, and you can only evaluate the security of a system once you understand the Use Cases and environment that the system operates in, including ...


8

An eavesdropper will see all three messages (M xor A), (M xor A xor B) and (M xor B) He combines them with (M xor A) xor (M xor A xor B) xor (M xor B) which gives M


8

This is a really, really, really bad idea. First off, this is not a one-time pad, as you're using the same pad to encrypt multiple blocks of data. This is exactly the same as sending multiple messages separately encrypted with the same pad. There are multiple trivial attacks against this scheme: If you have any known plaintext, the attacker can xor bytes ...


7

"Pseudo random generators are quick but predictable": well, that's true only in an ethereal, mathematical sense. In practice, if your PRNG is cryptographically secure and seeded with some initial randomness of large enough entropy (128 bits are enough), then it won't be predictable. However, if a PRNG is involved, this is not true "One-Time Pad" but a mere "...


6

"One-Time Pad" is more a concept than a strictly-defined algorithm. If there was a specification of an "OTP encryption algorithm" (say, in RFC format or similar), which tells where each byte goes and when, then that specification would tell you what happens when the key length does not match the data length. Moreover, if, in the case where the key is shorter ...


6

As others have said, this is not a One-Time Pad algorithm. Your proposed algorithm is actually called a "code book"; the primary difference being that you are substituting one word for a random set of letters of the same length. Code books have a long, well-documented history, and are still in limited use today. If you look at some of the books on ...


6

After some research it appears you are correct in your deduction that one-time pads are possible to use. There is just a minor problem of generating truly random keys and distributing them to whoever needs to send and receive messages. For a True RNG you can buy various hardware devices, or you can make your own or you can simply extract true random data ...


5

On a general basis, we don't want to encourage this kind of question: References to code are not good descriptions of cryptographic algorithms. Good descriptions use the language of mathematics, not programming. A description on a set of files on github is not permanent enough; if you ever change it, then this will make this question unreadable. There is a ...


5

Pidgin instant messenger has a plugin that implements OTP encryption of messages sent over the wire, called pidgin-paranoia. So there is at least one OTP cryptosystem out there. However, according to USE OTR's presentation at FOSDEM 2014, Pidgin is by no means secure software because it has 300,000+ lines of poorly audited C code, a lot of which is dealing ...


5

Well, first of, the number of files in the project Gutenberg, though vast by human standards, is really small for a computer, so it is workable to simply try them all. Apart from that remark, non-random pad data implies biases. If both the plaintext and the pad are "natural language texts", then the question becomes: given m XOR m', where both m and m' are "...


5

The problem with a one-time pad is distributing it to both parties. You can't just put it on a server for them both to download, because if you had a secure channel to do that then the two parties could just use that secure channel to communicate anyway. You pretty much have to get both parties physically together, which is obviously very limiting.


5

An enduring problem with all encryption is trust. You have to trust that the person you are sending a message to is on your side and won't deliver the message or key to someone who shouldn't have it. You have to trust that the people who invented the encryption scheme you are using didn't include a backdoor or a flaw on accident. With OTP, you have the ...


5

Quite simply, it's exactly the same as a two-time pad with one extra step. So, as you know the problem with re-using a one time pad is that it leaks information. If we encrypt m1 and m2 with pad1, that gives us: m1 xor pad1 = c1 and m2 xor pad1 = c2 So if we capture c1 and c2, we can then: c1 xor c2 to get m1 xor m2 If however, we re-use pad1 to ...


5

It's not a one time pad, it's a Vigenère cipher. You'd break this by organising into 50 character chunks so the aligned characters have been XOR'd with the same key character. You then perform a frequency analysis on this result to get the most likely key value. Repeat for all 50 characters.


Only top voted, non community-wiki answers of a minimum length are eligible