4 ms·

I'm not a crypto expert, but I understand the terms and arguments made in this article. "Wary" is the key word. If I have a true physical RNG, I can certainly

I'm not a crypto expert, but I understand the terms and arguments made in this article. "Wary" is the key word. If I have a true physical RNG, I can certainly make 2 DVDs full of identical random numbers. I can share one with you -- physically, not using email or barcodes. We can then communicate in the open, saying something like "beginning at position x on the DVD, here is my message" and nobody can read the part of the message that travels between the crypto functions They can still read my keystrokes, or gain entrance to where I work and video record me. They can gain useful information simply based on the pattern of you and I communicating. They even may be able to surreptitiously copy our OTP by using compromised software. But the OTP part is secure. The real problem is that the entire OSI stack is a leaking piece of crap. It's been broken at every level. So even if you have "perfect" crypto? It doesn't matter so much. ADD: Nothing's stopping you from using a OTP on top of a normal set of crypto algorithms. I like the OTP idea -- I'm just not sure in the current environment you're getting anything from it.

spacemanmatt 12y ago
I like your pragmatic way of analyzing this issue, and I think we have far more security work to do in operations than in algorithms.
vog 12y ago
> They can still read my keystrokes [...] They even may be able to surreptitiously copy our OTP by using compromised software. > The real problem is that the entire OSI stack is a leaking piece of crap. How is breaking into your computer an issue of the OSI stack? Are you using "OSI stack" as synonymous to "the whole operating system with all its running processes"?
- DanielBMarkham 12y ago
  Yes, I was, but more specifically I was giving two examples of the types of insecurities found in modern technology. It was a broad argument and a loose choice of examples. Thanks for pointing that out. The point was that "don't try this at home" is a little over-used from experts. Even novices can poke holes in the idea here -- so perhaps my loose argument was appropriate.
onion2k 12y ago
One problem with the security afforded to you by a physical media device (DVD in your example, or HDD, or whatever) full of numbers is that you're limited to sending an amount of data equal to the numbers you've got before you need to meet up again to exchange some more physical media. Reusing a one-time pad mitigates the security it offers pretty much entirely. If you're only encrypting textual messages that's no problem - even just a DVD is going to last you a damn long time. But if you're exchanging video and you want it to be properly secured with the level of protection a One-time Pad offers you then that DVD, or pile of 6TB HDDs, is going to run out of numbers quite quickly. A good private key encryption scheme doesn't have that limitation. That makes it better than a one-time pad for most practical situations.

spacemanmatt 12y ago

I like your pragmatic way of analyzing this issue, and I think we have far more security work to do in operations than in algorithms.

vog 12y ago

> They can still read my keystrokes [...] They even may be able to surreptitiously copy our OTP by using compromised software. > The real problem is that the entire OSI stack is a leaking piece of crap. How is breaking into your computer an issue of the OSI stack? Are you using "OSI stack" as synonymous to "the whole operating system with all its running processes"?

DanielBMarkham 12y ago
Yes, I was, but more specifically I was giving two examples of the types of insecurities found in modern technology. It was a broad argument and a loose choice of examples. Thanks for pointing that out. The point was that "don't try this at home" is a little over-used from experts. Even novices can poke holes in the idea here -- so perhaps my loose argument was appropriate.

onion2k 12y ago

One problem with the security afforded to you by a physical media device (DVD in your example, or HDD, or whatever) full of numbers is that you're limited to sending an amount of data equal to the numbers you've got before you need to meet up again to exchange some more physical media. Reusing a one-time pad mitigates the security it offers pretty much entirely. If you're only encrypting textual messages that's no problem - even just a DVD is going to last you a damn long time. But if you're exchanging video and you want it to be properly secured with the level of protection a One-time Pad offers you then that DVD, or pile of 6TB HDDs, is going to run out of numbers quite quickly. A good private key encryption scheme doesn't have that limitation. That makes it better than a one-time pad for most practical situations.