One Time Pad Encrypted Messaging System
Date
2020-05
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
University of Delaware
Abstract
One Time Pad encryption (OTP) is an unbreakable cipher under three specific circumstances. Firstly, the encryption Key must have a uniform distribution and be unpredictably random. Secondly, the Key used to encrypt data can never be used more than once. Lastly, the key must remain a secret. Under these conditions, OPT encryption is completely secure. Abiding by these conditions makes OTP not practical in many scenarios. Never reusing the Key means the size of the Key must equal the size of the cleartext. This puts a constraint on storage space making OTP encryption not useful for encrypting large amounts of data. Creating large amounts of cryptographically random data is difficult in low entropy systems.
This makes the cipher not useful for encrypting large amounts of data, effectively doubling the storage needed to hold cipher text vs the cleartext. Creating large amounts of cryptographically secure random data is difficult. This makes OTP encryption not practical for large scale encryption applications. However, for a small-scale application like a messaging system, OPT encryption is shown to be very practical. Only requiring a relatively manageable sized key to send many messages. This paper tests the relative practicality and security of the OTP cipher in a simple messaging system.
This messaging system should have Confidentiality, Integrity, and Availability. Confidentiality will be derived from the One Time Pad cipher. The OTP cipher will be used to encrypt messages. Unfortunately, the OTP cipher is inherently extremely malleable. This means there must be a way to ensure the message has not been modified in transit. Integrity is achieved by using a cryptographic hash function. This hash function is used by encrypting the clear text, hashing, then encrypting the
ciphertext and hash. This is to prevent a Non-Malleability-Known-Plaintext-Attack. Availability is achieved by hardening the OTP messaging system. It should be difficult for an attacker to critically foil the messaging system. This involves designing the messaging system to include message delivery acknowledgment functionality. This is achieved by having the sender send a message until the receiver has returned a specialized acknowledgment packet.
For the OTP messaging system to work keys must be exchanged, and managed. An In-Band key exchange would involve public-key cryptography. This would defeat the purpose of using an Informationally Secure cipher like the One Time Pad. The Out-of-band key exchange is conducted by encrypting the OTP key using an authenticated cipher, AES-GCM. The AES key is verbally exchanged from the sender to the receiver. The sender would create the keys for the messages it sends. These keys must be cryptographically random according to the rules of the OTP cipher. A secure deterministic random number generator (D-RNG) cannot be used, because then the cipher would only be as secure as the D-RNG’s seed value. Therefore, an external hardware-based cryptographic RNG is used. The users would need to purchase this hardware based RNG, and they would need to securely sample it for data.
The OTP messaging system would need a system to keep track of what portions of the OTP key have been used. This involves having each messaging include an internal message state. The message state for the sender goes from "uncreated", "unacknowledged", to "acknowledged". "Uncreated" means the OTP keys portion corresponding to this message has not yet been used. "Unacknowledged" means the OTP key portion has been used, and the message has been sent however, the message has not been confirmed delivered. "Acknowledged" means the message has been sent
and confirmed delivered. The message state for the receiver goes from undelivered to delivered. When the receiver receives the message it first checks if the message is authentic. If the message is not authentic the message is deleted. If the message is authentic, and the message state is undelivered, then the message is forwarded to the user. If the message is authentic, and the message state is delivered, then the message is not forwarded to the user. Regardless an acknowledgment is always sent back to the sender. This protects against replay attacks, because the user would not experience replayed messages. The way the sender and receiver know what OTP key portions correspond to each message is with the unique message number assigned to each message.
This OTP messaging system uses specific cryptographic tools and has specific statistics. The OTP cipher is used to encrypt clear text messages. The SHA3-256 hash is used to authenticate messages. Python 3.7 is used to program the messaging system. Regular socket programming with TCP is used for the internet communication protocol. The Pickle library is used to save the messaging system’s state. AES-GCM is used to encrypt the message state (the message state includes the OTP keys). True RNG v3 is the hardware-based cryptographic RNG used to generate the keys. Each message has a clear text of 256 Bytes with UTF-8-bit encoding. Each message sent uses a 576 Byte portion of the OTP key. One megabyte of the OTP key is good for sending 1736 messages.
Under scrutiny, the OTP cipher pales in comparison to other commonly used modern ciphers. This messaging service would be much easier to develop with modern cryptographic tools. Other ciphers do not deal with large key sizes. Keeping track of used key portions is simply unnecessary with other ciphers. The messaging system
would also be a lot more user friendly if Informational Security is sacrificed for Computational Security. Most users are unwilling to commit to Out-of-Ban key exchanges.
Furthermore, there is no practical difference between Informational Security and Computational Security. The One Time Pad can only provide Informational Security as its upside. It is possible to create cryptosystems with the OTP cipher. Unfortunately, the OTP cipher is simply not worth its difficulty. If there were computers with infinite computational power, then the OTP would be worth its downsides. However, modern commonly used ciphers provided more than enough security with the convenience of easy to implement libraries and functionality.
Description
Keywords
computer engineering, pad encrypted, messaging system