One-Time Pad Generator

Most ciphers are bets. They wager that some problem is too hard for the enemy’s mathematicians and machines, this year and for as long as the secret matters. One cipher makes no bet at all.

It needs a pencil, a sheet of random letters and the arithmetic of a clock face. Each letter of the message is added to one letter of key, the sheet is destroyed, and what goes out over the wire can never be read by anyone who lacks the matching sheet. That is not a boast about the computers of the day. It was proved in 1949, and a proof does not expire. The catch is that the same proof moves every difficulty out of the cipher and into the key: making it, carrying it, counting it, burning it. The history of the one-time pad is the history of those four chores.

Four conditions and one small sum

The usual statement has four conditions. The key must be at least as long as the message. It must be truly random. It must never be reused, in whole or in part. And it must stay completely secret between the two parties. Crypto Museum’s list of the rules adds two more that follow from those: only two copies of the key exist, and both are destroyed straight after use. Break any one of them and the guarantee is gone.

The sum itself fits in the margin of a newspaper. Number the alphabet from A = 0 to Z = 25. To send HELLO with the key XMCKL, add each pair and subtract 26 whenever the total passes 25. H is 7 and X is 23, which makes 30, which is 4, which is E. Then 4 + 12 = 16 for Q, 11 + 2 = 13 for N, 11 + 10 = 21 for V, and 14 + 11 = 25 for Z. The cipher text is EQNVZ.

In the tool above, set the key to Typed, enter HELLO and XMCKL, and press Encrypt. The first group is worked in exactly these numbers. The receiver subtracts instead: 4 - 23 is -19, add 26, and H returns.

That convention is a choice, not a law. Some printed pads came with a conversion table to use in place of the sums, and the same sheet can be worked the other way round, subtracting the key to encipher and adding it to decipher. Either way works as long as both ends agree. Agreement is the first thing a pad cannot supply for itself.

What Shannon proved

Claude Shannon published “Communication Theory of Secrecy Systems” in the Bell System Technical Journal in 1949. His definition of perfect secrecy is plain. After the enemy intercepts the cipher text, the probability of each possible message must be exactly what it was before. The interception has taught him nothing. He may guess, as he always could, but the letters in his hand give him no reason to prefer one guess over another.

The pad meets that test for a reason you can check by hand. EQNVZ is HELLO under the key XMCKL. Under the key TQURI the same five letters are LATER, and the tool will confirm it: hand the cipher text to the receiver, type that key instead, and decrypt. For every five-letter message there is exactly one key that produces EQNVZ, and since every key was equally likely to be drawn, every message stays exactly as likely as it was. There is no wrong key to rule out. More computing power does not help, because nothing is left to compute.

The proof also names its price. Perfect secrecy needs at least as many possible keys as possible messages, and for a steady flow of traffic the key must be produced at the same rate as the text. Shannon called this the disadvantage of perfect systems for large correspondence: the equivalent amount of key that must be sent. A short key that is stretched or repeated falls outside the theorem entirely.

Notice what was never promised. The proof does not hide that a message was sent, or how long it was. It does not show who wrote it, or that it arrived unaltered.

Paper, and the people who carried it

The idea is older than its proof. In 1882 a Sacramento banker, Frank Miller, published a telegraph codebook whose instructions told a banker to prepare a list of irregular “shift-numbers”, add one to the serial number of each code word, and erase every number once used, never to use it again. If a sum passed 14,000, the highest number in the book, the sender counted on from the first page. Nobody seems to have noticed. Steven Bellovin came across the book in the Library of Congress and published the find in 2011.

The version that entered history was electrical. Gilbert Vernam of AT&T filed a patent in September 1918 for a telegraph system that mixed each character of a message with a character from a key tape, and it was granted in July 1919. He and Joseph Mauborgne of the Army Signal Corps saw what made it secure: the key tape had to be perfectly random and never reused. By 1923 the German foreign office had put the same principle on sheets of paper.

Paper is where the name comes from. A pad was a small block of sheets printed with random letters or digits, usually in groups of five, and a fresh sheet was torn off for each message. Britain’s Special Operations Executive used pads between its offices in the Second World War and gave them to agents overseas late in the war.

The pad was often a second layer: the Soviet systems read in Venona first turned words and phrases into numbers with a codebook, then added random groups from the pad. Pad messages still went out to agents over numbers stations in 2015. KGB agents in Western Europe hid miniature pads inside walnuts. When Washington and Moscow opened their hotline in 1963 it ran on one-time tape machines built in Norway, and each side made its own key tapes and sent them by courier to its embassy in the other capital.

Look at what all of that describes. Printing, numbering, sealing, couriers, embassies, concealments, destruction. The cipher is one line of arithmetic. Everything else is the handling of key, and the groups of five and the numbered pages exist so that two people far apart can always agree on which symbols come next.

What reuse gives away

Use a sheet twice and the arithmetic turns on its owner. Two cipher texts made with the same key can be subtracted from each other, and the key, being the same in both, cancels. What remains is one message minus the other: no randomness in it at all, only two pieces of human language laid over each other. The tool shows this with pictures. Encrypted with one pad, each picture is noise. Combine the two noises and both pictures come back at once.

The most famous case began on 1 February 1943, when the United States Army’s signals agency at Arlington Hall started to examine Soviet diplomatic telegrams it had been collecting since 1939. Those messages were first turned into four-digit groups from a codebook and then enciphered by adding digits from pad pages that held 60 five-digit groups each. For a few months in early 1942, a time of great strain, the KGB’s cryptographic center printed duplicate copies of the key on more than 35,000 pages and bound them into separate pads. In autumn 1943 an analyst named Richard Hallock found evidence of the duplicates in Soviet trade messages.

It was a single duplication, and it was enough. Over the following decades American and allied analysts read portions of more than 2,900 telegrams sent between 1940 and 1948. The effort, later given the codeword Venona, closed in 1980. Some passages stayed unreadable after 37 years of work, and only messages that happened to share key could be attacked at all. The pad itself was never broken. A printing shop under pressure had ignored one of its conditions.

Reuse is one way to fail. Poor randomness is the other. The German foreign office printed its pads with frames of numbering machines, each a row of digit wheels, and a paper of its own from 1928 worked out that a frame of 48 five-wheel machines would begin to repeat after 100,000 sheets. It trusted the machine anyway. The output turned out to be predictable, and in 1944 and 1945 the United States Army’s Signals Intelligence Service solved the system. A pad with a pattern in it is only a stream cipher with extra paper.

Random, pseudo-random, and the other OTP

This matters for any pad made on a computer, including the one above. A pseudo-random generator stretches a short seed into a long stream. The stream may look flawless, yet the real key is the seed, and security drops from a theorem to a wager on an algorithm. The Internet’s own guidance on randomness warns that pseudo-random processes can produce pseudo-security. Browsers offer a generator described as cryptographically strong, seeded with entropy from the platform, and limited to 65,536 bytes per call. That is the best a web page can do, and it is good. It is not a noise source, and a pad made from it does not strictly meet Shannon’s condition.

There is also a small trap in turning bytes into letters. A byte has 256 values and 26 does not divide 256, so taking the remainder would make A through V slightly more common than W through Z. The fix is to keep only 234 of 256 values, nine for each letter, and throw the rest away. Bias that small still counts.

One more confusion is worth clearing up. The short numeric codes used for two-factor logins are one-time passwords, also shortened to OTP, and they are a different thing. They are computed from a shared secret and a counter or the clock, at least six digits long, with a default time step of 30 seconds. They prove identity and encrypt nothing. Their strength is the strength of the algorithm behind them, which is exactly the kind of bet the pad was invented to avoid.

What the method cannot do should be said plainly. It cannot authenticate a message or detect tampering. It cannot be made convenient, because the key is as long as everything you will ever send and must reach the other end by hand, in advance. It cannot survive a second use, a kept copy or a predictable generator. And it cannot be safer than the place where the arithmetic is done. The people who collect these machines advise a dedicated device, never a personal computer, and a pad that has passed through a browser, a printer and a waste bin has not been handled like a secret.

So print a pad, send a friend EQNVZ, and burn the sheet afterwards. The sum was never the hard part.