🚀 go-pugleaf

In <715637499@romeo.cs.duke.edu> trt@duke.cs.duke.edu (Tom Truscott) writes:

>>>Anyways, one-time pads are really effective in short
>>>messages and are reasonably secure on larger documents.

>Arguably this is backwards. As suggested in "Codebreakers",
>if I suspect that a "yes" or "no" decision is forthcoming, and I 
>intercept a 3 character long message, I can make a reasonable
>guess as to the message's contents.

nope, 'cause even the book I have on crypto written for 10-year-olds
says to pad your messages out to groups of five....

sotha ttraf fican alysis isnot asbig athre atasi tcoul dbexx

>More generally, "traffic analysis" is still a threat.  So some systems
>send continuously, just sending nulls or-ed with the pad
>(== the pad itself) when there is no real traffic.

This is doubly true, however.  Everybody who's been around knows that when
there are pizza delivery trucks headed for Foggy Bottom, Something Big is
going down.... a very simple "traffic analysis".  

Anything remotely resembling good code won't reveal the actual number of
characters in the message exactly; really good stuff, a la above, sends
synchronously and uses framing characters or some such...  on the other
hand, if you stumble onto something sending async, you can always tell
when something's going on when the message traffic goes way up... ;)

-- Glenn R. Stone (glenn.stone@eas.gatech.edu)
Nazi conservative Quayle NSA coverup watergate CIA breakin nuclear gun drugs