🚀 go-pugleaf

      Realize that as an operational issue, key distribution is THE
problem in military cryptography.  One-time systems are useful when two
sites have a long-term, prearranged need to communicate.  Links between
embassies and their capitals are good candidates for one-time systems;
both ends are fixed sites, no switching is required, and secure storage
for non-trivial amounts of keying material is available at both ends.
But one embassy can't talk to another using the same keys used for the
link to headquarters.  Every link; worse, every potential link, that is,
every pair of stations that might ever want to communicate; requires
separate keying material, most of which will never be used.  All this
keying material must be generated under secure conditions, moved around
by secure couriers, stored in containers which make tampering evident,
and accounted for administratively.  Remember that the keying material
gets used up by traffic; send too much traffic and you run out of keying
material.  In some cases, you send junk traffic continously just to make
traffic analysis futile; this really uses up keying material.  The
Washington/Moscow hot line is in fact operated in that mode.
     In a military environment, this is too restrictive except in
special cases, such as links between major headquarters.  Military
units need to communicate in unanticipated directions on short notice.
In many cases, a considerable degradation in security is acceptable in
exchange for better communications.  Much military traffic is secret only
for a short time (the time and place of tomorrow's attack will, after all,
be known by the enemy once it starts), and a level of protection sufficient
to protect the traffic for hours or days may be sufficient.  Tactical
communications can never be completely secure; there is always the danger
of a station being captured with the keys intact. So excessive precautions
in the cryptosystem may be unjustified.
      Many of the real questions today are not "how can we make an
unbreakable cypher" but "how can we arrange things so as to minimize the
information compromised when a station is captured".  (In this context;
"captured" covers any means by which the opposition gains physical access
to keying material.)  One would like, for example, to have a system in
which capture of the current keying material does not allow you to read
old traffic.  That's the kind of feature you need at the level of, say,
the Army company.

      So one-time systems are useful, but not the entire answer. 

					John Nagle