Chris Spackman – Cryptography

One-Time Pad

The One-Time Pad (OTP) is a symmetric cipher that uses a random key that is as long as the message itself, and the key is used only once. Think of it like two people sharing a notebook full of random letters — each page is used to encrypt one message, then that page is torn out and destroyed. The One-Time Pad is the simplest cipher that is provably unbreakable when used correctly.

Try It

Result

Step-by-Step

How It Works

Each letter in the plaintext is paired with the corresponding letter in the key. To encrypt, add them together using modular arithmetic:

• Encrypt: ciphertext letter = (plaintext letter + key letter) mod 26
• Decrypt: plaintext letter = (ciphertext letter − key letter) mod 26

For example, with plaintext H (7) and key K (10): (7 + 10) mod 26 = 17, which is R. To decrypt R (17) with key K (10): (17 − 10) mod 26 = 7, which is H.

Why It Is Unbreakable

If the key is truly random and used only once, the ciphertext reveals nothing about the plaintext. Here is why: for any ciphertext, every possible plaintext is equally likely. If you intercept the ciphertext "RACDU", it could decrypt to "HELLO", "WORLD", "PIZZA", or any other five-letter combination — it depends entirely on the key, and without the key there is no way to know which one is correct.

This is not just "hard to break" like other ciphers — it is mathematically proven to be impossible to break, even with unlimited computing power. Claude Shannon published the proof in 1949, in "Communication Theory of Secrecy Systems." He also showed the price: any cipher with this kind of perfect secrecy needs a truly random key at least as long as the message, used only once. The One-Time Pad is simply the most direct way to meet that requirement.

A Little History

The idea is older than the name. Frank Miller, a California banker, described a one-time key system for telegraph codes in 1882; his work was forgotten until the computer scientist Steven Bellovin rediscovered it in 2011. Gilbert Vernam of AT&T built a teleprinter version in 1917 (patented in 1919) that combined the message with a key punched on paper tape. Joseph Mauborgne of the U.S. Army Signal Corps added the rule that makes it secure: the key must be truly random and never reused. Shannon's 1949 paper then proved that a cipher used this way is perfectly secret.

The Catch

If the One-Time Pad is unbreakable, why does not everyone use it? Because it has serious practical problems:

• The key must be truly random. Not "random-looking" — genuinely random. Patterns in the key weaken the cipher. (The "Generate Random Key" button on this page uses your browser's cryptographic random number generator, the kind used to make real encryption keys, not the ordinary predictable kind used in games.)
• The key must be as long as the message. Want to encrypt a 1 MB file? You need a 1 MB key. Want to encrypt a movie? You need a key the same size as the movie.
• Each key can be used only once. Reuse a key on two messages and an attacker can subtract one ciphertext from the other, letter by letter. The key cancels out, leaving the difference between the two plaintexts, which can be exploited. (Computers do the same thing with XOR on bits.)
• The key must be shared securely. Both the sender and receiver need the same key. But if you have a secure way to share a key as long as the message… why not just use that secure channel to send the message itself?

The Key Distribution Problem

This is the fundamental challenge of symmetric encryption: how do you share the key? The One-Time Pad makes this problem painfully clear because the key is so large.

This problem is exactly what drove the invention of modern cryptography. Two brilliant solutions emerged:

• Diffie-Hellman Key Exchange — lets two people agree on a shared secret over a public channel, without ever transmitting the key itself.
• RSA Public/Private Key Generation — uses a pair of mathematically linked keys so that anyone can encrypt a message to you, but only you can decrypt it. No shared secret needed.

The One-Time Pad shows us why we need these tools. It is the bridge between traditional and modern cryptography.

Things to Try

• Encrypt "HELLO" with key "KWRSG", then try decrypting the result with a wrong key like "ABCDE". You get valid-looking text! This is why the OTP is unbreakable — any key produces a plausible plaintext.
• Encrypt two different messages with the same key. Why is key reuse dangerous? (Hint: what happens if an attacker subtracts one ciphertext from the other?)
• Use "AAAA" as the key (all A = all zeros). What happens to your message? What does this tell you about what A means as a key letter?
• Click "Generate Random Key" several times. Does the key look random? Could you predict the next one?