Hacker News Reader

Comment by andrewla | Hacker News Reader

While this may seem like a tempting statement, it is not really an answer, since "unbreakable" is not really well-defined. Clearly, "truly random" is a bit of a tough one to define. And sending the message length is a bit of an information leak itself. But even putting those aside, there's a bigger flaw.

The biggest problem in this mechanism is how does the other party get their one-time pad? An upper bound on the unbreakableness of the entire scheme is the unbreakability of transmitting a one-time pad; and if you can do that, then why not just send the actual message via that mechanism?

View on HN

You give each party a briefcase full of 4 TB hard drives full of random numbers generated from a USB attached atomic decay device.

Now for 1,2,10 years depending on your rate of communication you can communicate using the one time pad.

>why not just send the actual message via that mechanism?

The point is you only have to exchange pads periodically, not every time you communicate.

I mean, what you're saying here is that in addition to one-time-pad based cryptography, there is a "give a briefcase to the person"-based cryptographic system. In reality, I think lot more briefcase-based transfers are "cracked", as it were, than SSL sessions.

My problem is just that the proposed mechanism relies on already having an even more perfect mechanism, and thus cannot be the "only one", but is in fact strictly weaker than this other mechanism. So we have a contradiction, and we can get rid of the notion that there exists such a thing as an "unbreakable" system (or, alternatively, that it is a useful concept)

No, this is a a breifcase full of one time pad. If you could fit 32 4 TB hard drives full of pad in the brief case that would allow you to send 128 TB in the future securely using something like an XOR one time pad. Assuming you are just sending ASCII and compress it before sending/XORing you could send a lot more then 128 TB of ASCII.

This is pretty powerful. It means that organization which and periodically move physical assets securely can send information in a manner that is secure even if quantum computers reach their full potential.

Was "128 GB" a typo for "128 TB"?

Incidentally, the mechanism for sharing the pad doesn't have to be 100% secure, as long as you can reliably detect any compromises. If someone opens the briefcase while it's in transit, you just generate new pads and send another briefcase. To compromise the system, an adversary has to compromise the pad in transit without being detected.

No, the notion of the unbreakable one time pad is a great notion to have around.

It is the good standard for crypto systems. Yes it's unworkable in practice but that's exactly why nobody really uses it. It is useful for teaching and making comparisons.

Governments use it all the time. (Men with handcuffed briefcases and armed guards..)

Before you send your submarine to sea for example, you can provide them with many gigabytes of one time pad. They can then use this for their most secret communication.

> I think lot more briefcase-based transfers are "cracked", as it were, than SSL sessions.

Lots of SSL sessions are going on right now. It only takes a vulnerability like CVE-2014-0160 to change the score by 100 or so.

Briefcases: 1 in the last day

SSL sessions: 100 in the last day

Edit: if only CVE-2014-0160 had some evocative name.

How do you encrypt the hard drives?

I wouldn't trust some keys that had been lying around on an unencrypted hard drive for 1,2,10 years!

If I was using one-time-pads I'd probably be using them because I didn't trust encryption, so "unencrypted" wouldn't matter here.

In real-world implementations I think the security is probably based around a large number of men with guns.

Exactly, men with guns secure the one time pad. The data sent using that pad is secure.

Nit: I would consider one time pad to be a method of encryption.

Nit: I would consider one time pad to be a method of encryption.

Ah, true. But the encryption algorithm is much simpler to implement than most :-)

You don't get it at all.

> why not just send the actual message via that mechanism?

If you can, then there's no real need for using a one-time pad. But there's a benefit that comes from a fact that exchanging the random data is a completely separate process in time and space from sending the messages. You can do it once, spending all your resources to secure it. Imagine e.g. two governments establishing a secret emergency line by generating a few terabytes of random data in one physical place and then escorting each copy in armoured trucks to proper communication factilities.

BTW. exchanging physical "XOR's" for one-time pad communication is a plot point of Vernor Vinge's "A Fire Upon the Deep".

"unbreakable" may be not well-defined, but perfect secrecy is[1].

1. http://en.wikipedia.org/wiki/One-time_pad#Perfect_secrecy

Perfect secrecy refers to the ability to determine any information about the plaintext without decoding it. Not having it can be very useful to an attacker, but that isn't always the case. RSA, for instance, doesn't have perfect secrecy, because it leaks the Jacobi symbol (https://en.wikipedia.org/wiki/Jacobi_symbol) of the plaintext. However, that information is of limited utility, and it can be shown that determining more useful facets, for instance the parity of the plaintext, requires solving more unfeasible problems.

Actually, perfect secrecy refers to the ability to determine any information about the plaintext at all, given arbitrary decoding power. It's quite simple -- it means that given a standard distribution of keys and an a priori distribution over the plain texts the best estimate of the plaintext given the ciphertext is simply the a priori distribution (no additional information). For the binary case, Y(any distribution)+X(uniform)=Z(uniform) (mod 2), so that this is satisfied for any prior.

> why not just send the actual message via that mechanism?

suppose you can transmit information securely only for some time. Exchange one time pads ahead of time, and use them later to communicate over insecure channel

By assumption, the only way to "transmit information securely" is by one-time pads. So...

That was not the assumption. The assumption (or assertion) was that one-time pads were the only unbreakable encryption. There are ways of securing things other than encryption (most obviously physical isolation).

Ach! I let myself get drawn into a semantic argument, and it earned me my first downvotes!

My only point was that talking about one-time-pads as "unbreakable" encryption is not a useful discussion, since "unbreakable" and "encryption" need to be better defined.

If we expand the definition of "encryption scheme" sufficiently to allow transmission of secrets outside of cryptographic channels, then OTP is not even close to the only unbreakable system.

Only by explicitly defining attack vectors can we really get a good framework for reasoning about cryptography, and even then we know that we can prove an encryption technique is bad. For "goodness", all we can do is increase our confidence, until the day the confidence drops to 0.

Anyway, with this last salvo, I'll retreat from this conversation; it's pretty clear to me that my inane ramblings about semantics are as annoying to the community here as they are to me when other people make them.

>My only point was that talking about one-time-pads as "unbreakable" encryption is not a useful discussion, since "unbreakable" and "encryption" need to be better defined.

No they don't. You are receiving negative feedback because you are trying to adjust definitions that have been well-defined by the crypto community. When talking about the security of an encryption algorithm, the key distribution has absolutely nothing to do with it. Stop conflating the two.

>If we expand the definition of "encryption scheme" sufficiently to allow transmission of secrets outside of cryptographic channels, then OTP is not even close to the only unbreakable system.

Would you care to share with us some of these other unbreakable systems? Remember, the keys are the only thing that can be transmitted outside of the channel and they cannot be based on the information being encrypted.

"If we expand the definition of "encryption scheme" sufficiently to allow transmission of secrets outside of cryptographic channels, then OTP is not even close to the only unbreakable system."

Any scheme which allows sharing arbitrary amounts of random information is less than or equally secure as an OTP (security defined per symbol) since OTP reveals no information per symbol; also, it uses the minimum amount shared information to do so, provided your symbols are equiprobable.

I agree, OTP is optimal, it's just not unique, even by a very broad definition of what an OTP is. Sending a Turing machine to the other party through a secondary channel, for example, would produce an equivalently (not more) secure mechanism. Or sending a normal real number as the key, and the ciphertext is an index into the base26 expansion.

Technically, either of these could be slightly more secure, in that they need not leak the length of the plaintext. For transmitting a single "yes" vs. "no" answer, that could be a fatal attack vector for a naive OTP.

> And sending the message length is a bit of an information leak itself.

The known solution to this is to pad messages to some fixed length. The obvious drawback is that you have to choose the fixed length message to be as long as the longest message you may wish to transmit, which could result in having to transmit rather a lot of padding.

The equivalent of this for real-time communications is to transmit continually at a fixed bit rate regardless of whether you have any data to send at any given time.

Congratulations, you just reinvinted numbers stations.

Send random data that is probably meaningless, until which point you send real data. Let everyone listen in to the gibberish for 50 years, in the end, only the person with the key knows the message.

You do not actually have to define "truly random". You do have to trust that the mechanism you are using to generate keys (radioactive decay or rolling dice, for example) is unpredictable.

There is a more general point here, that sometimes seems to be lost in philosophical arguments: reality doesn't pay any attention to the meaning of words. If "unbreakable" is not well-defined (I am not sure that is so), then it is a problem within the domain of language, not cryptography.

Unpredictable and unbiased

When you transmit the pads may not correspond with when you want the message sent.

For example I may be able to send you a one-time pad securely today, but the message I need to tell you ("buy GM stock at 37.82") I won't know until next week -- at which point I may not be able to expediently send you the one-time pad securely.

Reply on news.ycombinator.com