3 ms·
Not only is One-time pad proven secure, it is also obvious without any knowledge of math.
by lederhosen 10y ago
Not only is One-time pad proven secure, it is also obvious without any knowledge of math.
- geofft 10y agoIt is not secure: it doesn't provide authentication (integrity protection) and it isn't nonce-reuse-resistant.
- loup-vaillant 10y agoIntegrity can be provided with a Wegman-Carter scheme, which come with a security reduction. The combination one-time pad + poly1305 for instance is provably secure. It's just impractical, and you have to rely on your chacha20 random number generator from /dev/urandom anyway. Also good luck finding a nonce-reuse resistant algorithm.
- geofft 10y agoDoes the correctness of Poly1305 not depend on P ≠ NP? I guess this boils down to whether the correctness of AES depends on P ≠ NP, which it might not since it's symmetric? The failure modes of reusing a nonce are never good, but some are far worse than others. The one-time pad's failure mode is particularly disastrous; it leaks the XOR of two plaintexts. There are a good number of algorithms that only leak whether the same message was repeated.
- loup-vaillant 10y ago> Does the correctness of Poly1305 not depend on P ≠ NP? Not that I know of. As far as I know the security reductions are unconditional. Even worse than revealing the XOR of 2 plaintexts is the key recovery enabled by GCM (source: other comments in this thread). And if you're that scared of nonce reuse, just Nevertheless, it doesn't matter. Avoiding nonce reuse is easy. And if you're really scared, just use a random nonce from a big enough space (192 bits, like XChacha20, are good). That way if you have access to a random source, you can turn any encryption algorithm into a nonce-less algorithm.