5 ms·
Yes, OTPs are vulnerable if you do the one thing that you're not supposed to do with a OTP, namely reuse the bits. The question for OTPs is whether there is an
by anamax 5y ago
Yes, OTPs are vulnerable if you do the one thing that you're not supposed to do with a OTP, namely reuse the bits.
The question for OTPs is whether there is an encryption or decryption oracle for a given OTP, not whether OTPs are vulnerable to such oracles.
- Animats 5y agoOTPs are vulnerable if you do the one thing that you're not supposed to do with a OTP, namely reuse the bits. YES. "One time" means "ONE TIME". Use once and destroy. The one time pad must be random, generated by a true random process. Not pseudorandom. Not generated by an algorithm. Not generated from a shorter key. Not reused. Not generated by humans hammering on typewriters (see Venona). One time keys are used for some crucial point to point links. Embassy to foreign ministry, higher military headquarters to high command, or spy to HQ.
- _fizz_buzz_ 5y ago> One time keys are used for some crucial point to point links. Embassy to foreign ministry, higher military headquarters to high command, or spy to HQ. I am very skeptical this actually used in practice anywhere. The one-time pad is prone to side-channel attacks, since sharing the secret key(s) is such a nightmare. Putting people on planes flying around the globe with bags full of keys or having long lists of keys lying around is a security nightmare. Using an asymmetric encryption scheme is in practice a lot safer.
- Animats 5y agoDeclassified NSA documents describe some of the systems.[1] Early systems used paper tapes for the key. One of the features was a tape slitter, so the tape could only be used one time before it was cut in half. Systems with floppy disks have been advertised. Mils Electronik sold one time key systems from the 1950s until 2017.[2] Early systems used paper tape, later systems were electronic and stored the keying material on PCMCIA cards. [1] https://www.nsa.gov/portals/75/documents/news-features/declassified-documents/friedman-documents/patent-equipment/FOLDER_425/41774259081336.pdf https://www.nsa.gov/portals/75/documents/news-features/decla... [2] https://cryptomuseum.com/manuf/mils/index.htm https://cryptomuseum.com/manuf/mils/index.htm
- Ar-Curunir 5y agoThe point is that with OTP in the IND-CCA2 game you can force the challenger to reuse keys And this translates to any real world scenario too.
- anamax 5y agoI understand "the point" - the problem is that said "point" isn't gospel/unquestionable. Forcing a challenger to reuse keys is not possible in every real-world scenario. Or rather, there are real-world scenarios where keys aren't/can't be reused. An evaluation criteria that assumes/requires otherwise is broken. If we're going to allow any game, then every encryption system is broken in my game, which requires that the keys and method be made available to the challenger.
- Ar-Curunir 5y agoI guess what I’m trying to say is that the length issues with OTP mean that it can’t be used in any scenario that requires even a weak form of non-malleability. Maybe you could try to do something with universal hashes, but it’s unclear.
- IX-103 5y agoYou only end up with length issues if you don't use a big enough pad. Just use a one-time pad that is uncountably infinite in length and require messages to be at most countably infinite in length. Sure you burn infinite bits on each message, but you'll never run out or reuse bits in the pad.