Hacker News Reader

Comment by RcouF1uZ4gsC | Hacker News Reader

Just like if I see a company or individual talking about “unbreakable” one time pads, my inclination is to either see them as selling snake oil or else really not have an understanding of modern encryption best practices, every time I see companies or individuals talking about PGP, I get the same feeling. PGP may have been pretty good in the 1990s, but it should be considered bad practice to use it now. It is very easy to misuse and likely has vulnerabilities in practice at least in the way people use it.

View on HN

Okay, I'll bite; what's the problem with one time pads? You have to exchange pads, but otherwise I was rather under the impression that they are unbreakable.

One-time pads are completely unbreakable if you use them correctly.

Using them correctly is impractically difficult for most people.

Your key has to be as long as the sum total length of all of the messages you send along that communications channel, and it has to be completely random. Reusing any key material, or having a less-than-random key, breaks the security. Losing your place in the gigantic key you're using doesn't break security, but it makes the result impossible to decrypt unless you try every possible offset within the key to see which one gives a reasonable decryption.

Therefore, someone selling a "one-time pad" security system isn't really selling a one-time pad system at all, because people wouldn't buy an email encryption solution which required them to generate, distribute, and keep their place in an impractically large key.

It's possible to come up with scenarios where a one-time pad is a good solution. Spies have used them in the past and are likely using them now. But they're impractical and they're used as a buzzword by scammers.

Wouldn't there be software to keep your place in the key? I don't see how the key is "impractically large" if it's only the size of your original email.

While we're here, (and if anyone could chime in and refine or otherwise pick apart my analogy), it's impractical in the sense that it still requires us to take care of all the key and session management business in the real world, which is why AEAD systems and the like are necessary (in order to reliably and safely construct "one-time pads" under the hood).

I've always considered the OTP to be (not in some strict, rigorously correct sense) more like an ideal, theoretical/abstract cipher, much like how a Turing machine, generally unconcerned with a practical limit in tape size, is a sort of idealized, abstract computer.

"It is the Turing machine of encryption schemes"?

> I don't see how the key is "impractically large" if it's only the size of your original email.

So you're only sending one email and not getting a reply?

Having a key as long as your plaintext is difficult.

Getting actually random (not pseudorandom) keys is very difficult.

Not reusing any key material ever is very difficult.

Exchanging the keys is difficult.

It’s not authenticated.

It’s just not useful in practice.

What do you mean? Is the concept that even if the one time pads are "information theoretically secure", they are not unbreakable, because of issues with keeping secrets in practice? For example, it doesn't matter how good your encryption standard is, if the enemy has root on your keyboard controller.

Reply on news.ycombinator.com