The Manual One-Time Pad

http://users.telenet.be/d.rijmenants/en/otp.htm

by transpute • 11 years ago

27 16 11 years ago

users.telenet.be

Though the article says "One-time pad is not a practical encryption system. However, if properly used, it will be absolutely secure and unbreakable", I've had to talk developers out of wanting to implement them in their protocols before.

Quick public service announcement about cryptography.

It's true that, from an information theory perspective, OTPs are unbreakable encryption.

However, unless you have a long history of cryptanalysis under your belt, don't even think about implementing one in software. This is a common mistake people make when they're first learning about cryptography.

Pitfalls:

1. You need to get two computers to have the same large chunk of random data without anyone knowing it. This becomes a horrendous key management problem.

2. Even if you don't know the one-time pad, if you flip bits in transit, the recipient will happily decrypt them. You can forge messages at will. OTP is unauthenticated encryption.

If you think your application needs one-time pads, use elliptic curve diffie hellman key agreement and stream ciphers instead (and remember to authenticate you ciphertext).

Better yet, hook into a library like libsodium to do this for you and don't play with fire. (I know the sort of people who love one-time pads are unlikely to ever listen to this particular advice, but they can't say I didn't warn them.)

ekyepyaport2• 11 years ago

I agree, people shouldn't really try to enjoy their hobbies. They should just do what everybody tells them.

Imagine if a bank were to accidently mistake your OTP implementation as a viable product. Oh, the humanity.

w0000t• 11 years ago

And prevent learning?

No, what you need to do, is to learn whatever you enjoy, as much as you want in any direction, but recognize your limited knowledge in the field and act accordingly.

Karunamon• 11 years ago

A bank? No. Some random person out there in an oppressive government? Infinitely more likely.

Crypto is a bit of a special case in programming in that's it's ridiculously easy to do wrong, and failures could have catastrophic consequences on people's real lives. If you want to play with it yourself, more power to ya, but for the love of all things good in the world don't put it out there without sufficient disclaimer that it's a hobby, untested project.

sarciszewski3• 11 years ago

http://www.cryptofails.com/post/75204435608/write-crypto-cod...

panic• 11 years ago

And if you're generating your one time pads using a (hopefully cryptographically-secure) pseudorandom number generator, then congratulations! You are literally reinventing a stream cipher except with enormous, non-reusable keys.

ekyepyaport2• 11 years ago

non-reusable keys! what a critique on one time pads!

and enormous keys too! you might need to store them on some sort of notebook or large paper thingie!

DanielBMarkham• 11 years ago

Speaking as a total novice, I've always found OTPs attractive.

Wish you had made a better argument here, for perhaps I'm missing it. Yep, key management is a problem. That's all I got, and I know there had to be more.

Do you know of any longer treatments of this subject? Sure would love to read them.

I mean, I'm thinking if I want to share data with a friend, I get a hardware true RNG, cut a couple of 1TB SSDs full of random noise, and hand him a copy. With that amount of data, I'm thinking he and I are good to go for the rest of our lives. (Of course, commercial applications have other constraints)

_fizz_buzz_2• 11 years ago

Here is the thing, the cryptography is really not the weak part of a communication system. You really don't gain anything by using a one-time pad over something like AES-256 in any practical sense. You're only making the part of your system stronger that is already more than strong enough (From a thermodynamics point of view you couldn't even brute force AES-256 if you had a supernova as an energy source [1]). Difficult parts of a secure communication system are authentication, key-exchange, etc.

Example how to compromise your system: I send your friend a message with some random data and pretend to be you. Now he doesn't know what's going on and you two are out of sync and cannot securely re-sync your keys without meeting up again.

[1] https://www.schneier.com/blog/archives/2009/09/the_doghouse_...

sarciszewski3• 11 years ago

Wish you had made a better argument here, for perhaps I'm missing it.

I did have a better argument here. It was point 2.

Unauthenticated encryption is dangerous:

https://paragonie.com/blog/2015/05/using-encryption-and-auth...

tptacek• 11 years ago

If you use a computer program to generate random numbers for a "one-time pad", you're not really using a "one-time pad"; you're using an ad hoc stream cipher keyed by your RNG.

(Conventional stream ciphers are themselves the DRBG cores of RNGs.)

It's not that stream ciphers are bad --- but ad-hoc cryptography almost always is. Just pick a well-implemented stream cipher, one that was designed to be a stream cipher, and use that instead. One-time pads are almost useless in practice.

mateus1• 11 years ago

Lovely, I'm currently taking Stanford's Criptography course on Coursera and it's both entertaining and enlightening. I highly recommend it. https://class.coursera.org/crypto-015/

whistlerbrk• 11 years ago

Sorry for any noise but: ||users.telenet.be^ is reported as 'Malware domains (long-lived) • Malware domains' for me while using microblock.

The Manual One-Time Pad

Related Stories