4 ms·

I understand "the point" - the problem is that said "point" isn't gospel/unquestionable. Forcing a challenger to reuse keys is not possible in every real-world

by anamax 5y ago

I understand "the point" - the problem is that said "point" isn't gospel/unquestionable. Forcing a challenger to reuse keys is not possible in every real-world scenario. Or rather, there are real-world scenarios where keys aren't/can't be reused. An evaluation criteria that assumes/requires otherwise is broken. If we're going to allow any game, then every encryption system is broken in my game, which requires that the keys and method be made available to the challenger.

Ar-Curunir 5y ago
I guess what I’m trying to say is that the length issues with OTP mean that it can’t be used in any scenario that requires even a weak form of non-malleability. Maybe you could try to do something with universal hashes, but it’s unclear.
- IX-103 5y ago
  You only end up with length issues if you don't use a big enough pad. Just use a one-time pad that is uncountably infinite in length and require messages to be at most countably infinite in length. Sure you burn infinite bits on each message, but you'll never run out or reuse bits in the pad.
  - Scarblac 5y ago
    How do you get both sides to have the same infinite random pad? I thought the whole problem with one time pads was that they had to be distributed to the other side physically and thus were always finite.
    - anamax 5y ago
      Sarcasm...
    - nybble41 5y ago
      > How do you get both sides to have the same infinite random pad? With Quantum Key Distribution both sides have access to identical streams of random bits not available to anyone else. Without invoking quantum mechanics, you can just treat the portion of the pad you have on hand as a prefix of an infinitely long pad which is being delivered incrementally. If you run out of pad bits you just pause and wait for someone to hand-deliver a new set of identical storage devices to both parties with the next segment of the pad. This is the same principle behind treating physical computers as "Turing complete" when a Turing machine is technically defined to include an infinitely-long tape—you can always extend the system with more storage as needed.
- anamax 5y ago
  Malleable or not is a function property that doesn't make sense for OTPs. The problem is that while a OTP's outputs are determined by its inputs, a OTP's inputs are always different. That said, a one time pads are non-malleable if you don't reuse the bits (and the bits are truly random). If you do reuse the bits, it's not a one time pad. That said, there are no length issues with a One Time Pad. Or rather, the length issue with one-time-pads is that you can't reuse pad bits, not just within a given message but across all messages that ever use that pad, hence the name ONE TIME Pad. One time pads are necessarily as large as the data to be encrypted. (You might be able to get away with some fraction of the total number of "to encrypt" bits, but you can't reuse them.) Schemes which reuse "encryption bits" do not have that limit and are much smaller.
- anamax 5y ago
  One issue wrt malleability is whether/how one can recognize that a cyphertext or a plaintext is "valid". If you just xor with a OTP (which means that every cryptotext is valid) and every plaintext is valid, the receiver can't look at the cyphertext or the plaintext and recognize whether a MITM modified the message. However, the same is true of any crypto system where every cryptotext and plaintext is valid. However, if there's some way to recognize/distinguish valid plaintext, OTPs are non-malleable.

by anamax 5y ago

Ar-Curunir 5y ago

I guess what I’m trying to say is that the length issues with OTP mean that it can’t be used in any scenario that requires even a weak form of non-malleability. Maybe you could try to do something with universal hashes, but it’s unclear.

IX-103 5y ago
You only end up with length issues if you don't use a big enough pad. Just use a one-time pad that is uncountably infinite in length and require messages to be at most countably infinite in length. Sure you burn infinite bits on each message, but you'll never run out or reuse bits in the pad.
- Scarblac 5y ago
  How do you get both sides to have the same infinite random pad? I thought the whole problem with one time pads was that they had to be distributed to the other side physically and thus were always finite.
  - anamax 5y ago
    Sarcasm...
  - nybble41 5y ago
    > How do you get both sides to have the same infinite random pad? With Quantum Key Distribution both sides have access to identical streams of random bits not available to anyone else. Without invoking quantum mechanics, you can just treat the portion of the pad you have on hand as a prefix of an infinitely long pad which is being delivered incrementally. If you run out of pad bits you just pause and wait for someone to hand-deliver a new set of identical storage devices to both parties with the next segment of the pad. This is the same principle behind treating physical computers as "Turing complete" when a Turing machine is technically defined to include an infinitely-long tape—you can always extend the system with more storage as needed.
anamax 5y ago
Malleable or not is a function property that doesn't make sense for OTPs. The problem is that while a OTP's outputs are determined by its inputs, a OTP's inputs are always different. That said, a one time pads are non-malleable if you don't reuse the bits (and the bits are truly random). If you do reuse the bits, it's not a one time pad. That said, there are no length issues with a One Time Pad. Or rather, the length issue with one-time-pads is that you can't reuse pad bits, not just within a given message but across all messages that ever use that pad, hence the name ONE TIME Pad. One time pads are necessarily as large as the data to be encrypted. (You might be able to get away with some fraction of the total number of "to encrypt" bits, but you can't reuse them.) Schemes which reuse "encryption bits" do not have that limit and are much smaller.
anamax 5y ago
One issue wrt malleability is whether/how one can recognize that a cyphertext or a plaintext is "valid". If you just xor with a OTP (which means that every cryptotext is valid) and every plaintext is valid, the receiver can't look at the cyphertext or the plaintext and recognize whether a MITM modified the message. However, the same is true of any crypto system where every cryptotext and plaintext is valid. However, if there's some way to recognize/distinguish valid plaintext, OTPs are non-malleable.