🚀 go-pugleaf

In article <434@ethz.UUCP> wyle@ethz.UUCP writes:
>Random bits, generated from a radioactive source and calibrated counter
>are collected, and distributed by courier to remote sites.
>
>Messages are encoded via bit-wise exclusive-or, and transmitted via
>non-secure telecommunications.  The destinations use the courier-provided 
>random bits from the key tape to decode the messages.  Each bit is
>discarded after use.  Every few months, a new tape is sent by courier.

Certainly such a system, known generically as a "one-time pad"
after an analogous scheme used by spies, is theoretically
secure against cryptanalytic attack on the cipher stream.
Such a system used to be used for the Washington-Moscow hot
line teleprinters (for all I know it still is).  Although
security is in general a statistical matter (i.e. a measure of
the PROBABILITY of being able to correctly determine the plain
text under certain optimal assumptions), a one-time pad system
is absolutely unbreakable by statistical or algebraic analysis.

Any weaknesses in such a scheme have to lie elsewhere.  For
example, if the key bits are not really random (this CAN
happen; it happened in preparing the Rand Corp. table of a
million random digits!), then security is in theory
compromised; in practice, this is likely to be insufficient
for cracking the system, but nevertheless it is wise to put
a randomness monitor on the key stream and not use any long
run of key that tests out as "insufficiently random" (it
may be necessary to re-calibrate the equipment in this case).

Another line of attack is to collect discarded key tapes from
the dumpster and use them to read past messages.  (Would any
outfit be so stupid as to not permanently destroy the key tape?
It happens.)

Making a copy of the key while it's being "couriered" seems like
a useful tactic, if one can arrange it (this is not impossible).

Believe it or not, but sooner or later the encryptor will fail
and generate encrypted text that is easily readable (perhaps
entirely in clear!).  It is not considered "cheating" for a
cryptanalyst to use the resulting cheap decryption.

Easiest is to simply access the information before or after
the encrypted channel.

There are other possibilities, but generally a cipher system
of this type is very useful as part of a secure cryptosystem.
Its main drawback is the requirement for secure transmittal
of keys whose volume equals that of the message traffic.  In
cases where this is not an insurmountable obstacle, I highly
recommend one-time pad encryption.  (Other cases call for
different methods.  Warning: any system that has a key length
that is sufficiently shorter than the encrypted text is not
theoretically secure.  [How short is too short depends on
structural properties of the cryptosystem.]  Whether or not
it would be worth NSA's time and resources to break such a
system depends on the probable benefit of doing so.)

I think the optical disk might help make one-time pad systems
much more feasible than has historically been the case; then
the weakest point will be physical security for storage of the
disks.  (Note: no security is lost because of having to
transmit a key location identifier in the message header,
which is necessarily in the clear.)  I personally would LOVE
for there to be a practically unbreakable encryption system in
wide use; snoops do not deserve a break.