Intro to the One-Time Pad Cipher

eyeball art

The post Intro to the One-Time Pad Cipher first appeared on Qvault.

In cryptography, the one-time pad, or OTP is a way of encrypting information so securely that it’s impossible to be cracked. That said, OTP has a major drawback in that it requires both parties to have access to the same key before a message is encrypted.

Sorry to interrupt! I just wanted to mention that you should check out my new free Go cryptography course. It’s designed to teach you all the crypto fundamentals you’ll need to get started in cybersecurity.

Start Cryptography Course

How the one-time pad cipher works

When using the one-time pad, a message and a secret key are required to start. Each bit of the original messageg, assuming we can use binary data, is encrypted by using an XOR operation on it and the corresponding bit from the secret key.

Refresher on XOR

XOR, or “exclusive or” is a binary operator that works with binary data. It returns true if both of its inputs are opposites (one false and one true), otherwise, it returns false.



true XOR false = true false XOR true = true true XOR true = false false XOR false = false


Code language: PHP (php)


Check out my other article, why exclusive or is important in cryptography, if you want more information.


One-time pad step-by-step


So, for example, if we start with the message “hello word” and the key “I not know”, first we’d covert the text to binary data.




hello world = 01101000 01100101 01101100 01101100 01101111 00100000 01110111 01101111 01110010 01100100 I not know = 01001001 00100000 01101110 01101111 01110100 00100000 01101011 01101110 01101111 01110111


Next, we’ll perform the XOR operation on all the data.




01101000 01100101 01101100 01101100 01101111 00100000 01110111 01101111 01110010 01100100 XOR 01001001 00100000 01101110 01101111 01110100 00100000 01101011 01101110 01101111 01110111 = 00100001 01000101 00000010 00000011 00011011 00000000 00011100 00000001 00011101 00010011


Code language: PHP (php)


The resulting binary data is now the “cipher text”. In order to convert it back, all we need to do is XOR the ciphertext with the key and we’ll get the original message back.




00100001 01000101 00000010 00000011 00011011 00000000 00011100 00000001 00011101 00010011 XOR 01001001 00100000 01101110 01101111 01110100 00100000 01101011 01101110 01101111 01110111 = 01101000 01100101 01101100 01101100 01101111 00100000 01110111 01101111 01110010 01100100


Code language: PHP (php)


Convert the result back to text and we have the original message decrypted.




01101000 01100101 01101100 01101100 01101111 00100000 01110111 01101111 01110010 01100100 = hello world


Perfect secrecy in the one-time pad


A cipher is said to have perfect security if an attacker who has access to only the ciphertext can infer absolutely nothing of interest about the plaintext. The one-time pad does have perfect security. That said, it only has perfect security if the following conditions can be met:


    

  1. The key must be at least as long as the plaintext
    2. 

  2. The key must never be reused
    3. 

  3. The key must be kept completely secret to the outside world yet shared by both parties
    4. 

  4. The key must have a uniform distribution that is independent of the plaintext
    5. 



The Caesar cipher is a great example of a cipher that is not perfectly secure or practically secure. As we demonstrated earlier, when given access to the ciphertext of a Caesar cipher, an attacker can see the positions and patterns of characters in the plaintext.


Issues using the one-time pad in production


Most production ciphers are not perfectly secure, but are “close enough”. In short, trade-offs are made that add to the practical security of a system while sacrificing the perfect theoretical security of the cipher itself.


In accordance with the requirements outlined above, it’s really hard to implement a secure one-time pad in a real-world system. Let’s look at the first requirement, that the key needs to be at least as long as the plaintext it encrypts. This means that if I want to encrypt the contents of my computer’s hard drive, I need a key that’s hundreds of gigabytes in length. There’s no way I’ll remember that key, let alone be able to write it down.


The second requirement, that the key can’t be reused, is a huge pain! This means memorizing keys is out of the question because I always need a new one. Not only that, but whatever security vulnerabilities are introduced by needing to communicate a shared key to my intended recipient will be repeated each time a new message is sent.


Lastly, the last requirement, that it must be kept secret yet somehow communicated to the intended recipient, is a tall order. In fact, all symmetric encryption algorithms suffer from this problem. As a result, if you need to communicate with another entity you probably need to use a separate asymmetric encryption scheme.


Example of the one-time pad code in Golang




func encrypt(plaintext, key []byte) []byte { final := []byte{} for i := range plaintext { final = append(final, plaintext[i]^key[i]) } return final } func decrypt(ciphertext, key []byte) []byte { final := []byte{} for i := range ciphertext { final = append(final, ciphertext[i]^key[i]) } return final }


Code language: Go (go)










Ready to get coding?


Try our coding courses free


Join our Discord community







Have questions or feedback?


Follow and hit me up on Twitter @q_vault if you have any questions or comments. If I’ve made a mistake in the article be sure to let me know so I can get it corrected!









source https://qvault.io/cryptography/one-time-pad-cipher/






































Comments











Post a Comment























Popular posts from this blog









Why is Exclusive Or (XOR) Important in Cryptography?




















Image







    If you are getting into cryptography, or just trying to understand the fundamentals, you may have noticed that the exclusive-or operation is used quite often, especially in ciphers.  What is XOR ( ⊕ )?  XOR, or “exclusive or” operates on binary data. It returns true if both of its inputs are opposites (one false and one true), otherwise, it returns false.     An example in go code would be something like:  func exclusiveOr(a bool, b bool) bool {         return a != b }  XOR Cipher – The Perfect Cipher  The XOR operation can be used as a simple cipher for encrypting and decrypting messages with a single key. This is known as symmetric encryption.  It is interesting to note that if:   The key is the same size as the message  The key is kept secret and generated truly randomly   Then the cipher is impossible  to crack. This is known as a one time pad . However, a simple XOR shouldn’t be used in production due to the key length needing to be too long to be practical.  Cipher Example  A...








Read more










Base64 vs Base58 Encoding




















Image







 By Lane Wagner –  @wagslane  on Twitter   Base64 is one of the most popular encoding formats for representing data. Have some binary data? Base64 encode it for convenient readability and parsing. Base58 is just another encoding format (with 58 characters instead of 64, and has gained popularity largely due to Bitcoin and other cryptocurrencies.  When it comes to data encoding, there is typically a trade-off made between:   Human Readability: Do humans have a good idea of what is being represented at a glance?  Efficient data compression: How many bytes are used to represent the same data?   Let’s rank Base58, Base64, and ASCII encoding against each other using these metrics!  First: A Note on Binary  All data is stored in a raw binary format on computers. These encoding formats (Base64, Base58, and ASCII) are just different ways of reading and writing binary data. For example, in Base64 the binary code 000000  represents the letter A , but in ASCII the binary 00000000  repres...








Read more










(Very) Basic Intro to Hash Functions (SHA-256, MD-5, etc)




















Image







 This is going to be a basic introduction to hash functions. I will assume most of my audience is here to gain an understanding of why hash functions are used and the basic idea of why they work. My goal is to explain it in a general sense, I will be omitting proofs and implementation details and instead focusing on the high-level principles.     Why Use A Hash Function?  Hash functions are used all over the internet in order to securely store passwords, find duplicate records, quickly store and retrieve data, and more. For example,  Qvault  uses hashes to extend master passwords into private encryption keys.  A longer list of uses here:  https://en.wikipedia.org/wiki/Hash_function#Uses  I want to focus on several important features of hash functions, arguably the most important features.   Hash functions scramble data deterministically  No matter the input, the output of a hash function always has the same size  The original data can not be retrieved from the scrambled d...








Read more