🚀 go-pugleaf

In article <1992Nov11.173642.29608@ee.eng.ohio-state.edu>, 
     butzerd@columbia.eng.ohio-state.edu (Dane C. Butzer) writes:

> In the FAQ (Thanks to Larry Loen for this... it is informative...), the
> following is stated about pseudo one time pads:

>   and so permits cryptanalysis.  "Random number generators" are
>   frequently dreamed up by newcomers as a "pseudo one time pad",
>   but they are notoriously vulnerable to analysis, all
>                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>   independent of whether the pseudo-random stream satisfies
>   randomness tests or not.
> 
> My question is, why?  Now before I get roasted & told to "read the
> literature..." and "your an idiot...", I have read the literature.  I've
> sufficiently random (ie. NOT some type of feedback shift register or linear
> recurrence equation, but something random in a cryptographic as well as a
> statistical sense), and you follow the one time rule (ie. only use any key
> ONCE - never encrypt 2 files with the same key), this should be pretty
> secure.  For example, would the following be "vulnerable to analysis"?
> 
> 1) DES a file of ASCII 0's (of the same length as the plain text) with
> some key - this gives you a pseudo-random bit stream.
> 
> 2) XOR this with the plain text ---> cipher text.
> 
> This is pseudo one time pad that I don't think would be "easy" to break.

    Dane, do you happen to have a working implementation of the DES handy?
Good.  Now, make a file of ASCII 0's and encrypt it with some key.  Lookee,
Lookie, you get a list of random bits!  64 BITS LONG, to be exact, and the
same list is repeated for the length of the ciphertext file.  That's a big
reason why cryppies don't use BLOCK CIPHERS like the DES for one-time-pad
generation.  Of course, it would work fine if you limited your messages to
a length of 8 bytes... ;-)
    Using cypher-block chaining would create a more random-LOOKING bit
stream, but intuition tells me that it would have similar faults, and would
be reasonably easy to break as well (of course, I could be wrong...).
    I think you're probably looking at the one-time-pad scheme as a way of
IMPROVING on the DES.  Remember, though, that only OTP ciphers that use
truly random numbers are perfectly secure (in transmission, anyway), and
using a PRNG will always reduce this security to some degree.  To break any
encryption scheme like this, your adversary need only break the PRNG to do
it.  If this generator is the DES, then your OTP cipher scheme is no more
cryptographically secure than the DES itself.
    Finally, if you're going to use it as a generator, why not just encrypt
the plaintext with the DES in the first place, and skip the XOR step?