One-Time Pad
A canonical cipher with proven perfect secrecy — and nearly impossible to use correctly
Perfect secrecy requires an independent, uniformly random secret pad at least as long as the message, used once. No authentication.
Can an attacker change what you read?
Perfect secrecy protects confidentiality. It does not authenticate the message. In this letter-based model, adding a shift Δ to one ciphertext letter changes the receiver’s corresponding plaintext letter by the same Δ modulo 26. The attacker needs neither the pad nor the original letter to make that change.
- Intercepted ciphertext
- Altered ciphertext
- Sender’s plaintext
- Receiver’s plaintext
Reveal the sender data to inspect the result. A predictable letter shift does not mean the attacker can create a meaningful sentence without knowing the original text. There is no authentication check in this toy, so the receiver accepts the modified letters. A real system needs message authentication in addition to encryption.
Teaching limits: This is an original fixed example with a displayed, non-secret pad, not a secure communication tool or a randomness demonstration. Hiding fields only changes the view; the values remain available to this browser. The attack works even with a truly random, secret, single-use pad.
Reading: Jonathan Katz and Yehuda Lindell, Introduction to Modern Cryptography, revised third edition, §4.1.2, “Encryption vs. Message Authentication”; Niels Ferguson, Bruce Schneier and Tadayoshi Kohno, Cryptography Engineering (2010), Chapters 2 and 6. See modern cryptography for the wider transition from historical ciphers to secure systems.
Why This Matters
The one-time pad is a canonical example of perfect secrecy when its assumptions hold. Claude Shannon’s 1949 proof of its perfect secrecy is a cornerstone of information theory — and the VENONA project showed exactly what happens when its rules are violated.
Frank Miller described a one-time pad system in 1882. Gilbert Vernam developed a teleprinter system in 1917 and received its patent in 1919. But it was Claude Shannon who proved in 1949 that the OTP achieves perfect secrecy — ciphertext reveals absolutely nothing about the plaintext to an attacker with unlimited computing power.
The VENONA project showed exactly what happens when the rules are broken: Soviet signals officers reused key pages under WWII supply pressure. Army codebreakers at Arlington Hall — work later continued under the NSA — decoded thousands of messages and identified Julius Rosenberg, Klaus Fuchs, and other Soviet agents.
Binary OTP: C = P XOR K; P = C XOR K
Letter OTP used below: C = (P + K) mod 26
P = (C − K) mod 26
Example:
Plain: H E L L O = 07 04 11 11 14
Key: X M C K L = 23 12 02 10 11 (illustrative pad)
Cipher: 30 16 13 21 25 mod 26 = E Q N V Z
Four requirements for perfect secrecy:
1. Key must be uniformly random and independent of the message (not pseudorandom)
2. Key must be as long as the message
3. Key must never be reused
4. Key must be kept secret
Without these assumptions, the perfect-secrecy guarantee does not follow
About this demo: The demo works in letters: each plaintext letter is shifted by the corresponding key letter (mod 26). Leave the key blank and a random pad is generated with the browser's secure random source and appended to the output as [Key: …]. A key shorter than the message is rejected rather than repeated. The displayed pad is available to this browser, so this is not confidential communication. Browser-generated randomness does not demonstrate the information-theoretic assumptions of an ideal physical random source.
Shannon's proof (1949): For any ciphertext C and any possible plaintext P, P(plaintext=P | ciphertext=C) = P(plaintext=P). The ciphertext provides zero information about the plaintext. An attacker with unlimited computing power cannot improve on the best guess justified by the plaintext's prior distribution.
For a binary reused pad, C1 XOR C2 = P1 XOR P2: the key cancels, exposing a relation between the plaintexts. That relation may support crib-based recovery, but need not uniquely determine both messages. VENONA exploited reused Soviet decimal additive material and required codebook reconstruction and extensive analysis. It began in the US Army’s Signal Intelligence Service in 1943; NSA inherited the work later.
| Concept from One-Time Pad | Modern Evolution |
|---|---|
| Perfect secrecy (Shannon, 1949) | Information-theoretic vs computational security: the fundamental distinction |
| XOR as cipher operation | Many modern stream ciphers combine data with a pseudorandom keystream using XOR |
| Key = message length | Long secret pads create distribution and storage costs; public-key key establishment addresses a different security model |
| Key reuse is catastrophic | Modern stream constructions require appropriate nonce and keystream handling; they can safely reuse a long-term key under their specified conditions |
Message: A T T A C K (6 letters) As numbers (A=0): 0 19 19 0 2 10 Illustrative key: 7 14 3 8 25 16 (fixed example; no random-source provenance claimed) Encrypt — add mod 26: A(0) + key(7) = 7 mod 26 = 7 → H T(19) + key(14) = 33 mod 26 = 7 → H T(19) + key(3) = 22 mod 26 = 22 → W A(0) + key(8) = 8 mod 26 = 8 → I C(2) + key(25) = 27 mod 26 = 1 → B K(10) + key(16) = 26 mod 26 = 0 → A Ciphertext: H H W I B A Decrypt — subtract mod 26: H(7) − key(7) = 0 mod 26 = 0 → A ✓ H(7) − key(14) = −7 mod 26 = 19 → T ✓ Why unbreakable: HHWIBA could decrypt to any 6-letter message with some key. The ciphertext does not change the prior probabilities of the possible plaintexts.
- Enigma Machine — A finite-state rotor system, distinct from an independent random pad
- Lorenz Cipher — XOR-based teleprinter cipher inspired by OTP principles
- Vigenère Cipher — Repeating-key polyalphabetic: what happens when the key is shorter than the message
| Exhibit | 36 of 172 |
| Era | 1882 · Theoretical |
| Trust | Secure (Modern) |
| Inventor | Miller’s 1882 proposal; Vernam’s teleprinter work; Shannon’s 1949 theory |
| Year | 1882 / 1917 |
| Key Type | Random key same length as message (used once) |
| Broken By | Never — if rules followed. VENONA: key reuse exploitation |
Sources and Reading
Claude E. Shannon, Communication Theory of Secrecy Systems (1949), §10, for perfect secrecy; Alfred J. Menezes, Paul C. van Oorschot and Scott A. Vanstone, Handbook of Applied Cryptography (1997), §1.5. The displayed example keys are teaching data, not evidence of a particular randomness process.