I mean if a Roman general could…

1 GB?

The size is fairly irrelevant. 1 GB fits on a microSD card many times smaller than a Roman General's hand-written cypher.

True, but it can be copied and returned quickly without the victim knowing, and you have to trust every device you put that SD card into to read the pad.

How do you handle that SD card in practice to do your communication?

My point is, if anyone is on to you and can physically get to you (or anyone else in the group), there is a high risk they can get hold of the data.

That's why you put it behind a secret menu in an iPod https://tidbits.com/2020/08/17/the-case-of-the-top-secret-ip...

also how do you ensure the messages haven't been corrupted in transit

You can never ensure that your communication channel isn’t corrupted. But with a one time pad you’ll just receive unreadable garbage then. You‘re also free to sign or checksum messages before encryption.

if an adversary xors their guess of part of your message and what they want it to say with the one-time-pad ciphertext, they can make it say what they want if the guess is right; this is a general vulnerability with stream ciphers

if they guess wrong, there's a little unreadable garbage in the message, but in many scenarios they only have to guess right once

so you need some kind of message authenticator like hmac

Good point I guess that’s the same as the “heil h**er” vulnerability

Maybe some kind of low density salting would make messages hard to guess but not too hard to read

1. For each letter of the plaintext, concatenate "dontcorruptmebro"

2. Grab 17 letters from the pad (I'm assuming pad means the randomly chosen letters that make up the 1 gigabyte of shared secret among the participants)

3. Convert the first letter of the pad to a number (let's say 1-26)

4. Right-shift the message by that amount and let the letters wrap around: e.g., if the plaintext letter is g and we're shifting by 1 the plaintext becomes "ogdontcorruptmebr"

5. Encrypt with pad (not a cryptographer, but I'm assuming this means adding a character of the shared secret with a character of the plaintext, and wrapping around if it goes past the end)

6. Send

7. Decrypt with pad

8. Left-shift and wrap by $first_pad_letter_value (i.e., the same value we used to right-shift and wrap above)

9. Remove the "dontcorruptmebro" part to concatenate the plaintext letters to reveal the original message

10. Rinse and repeat, and do whatever secure messengers do if/when you receive a part of the "dontcorruptmebro" that isn't "dontcorruptmebro"

I only thought about this for a few minutes, and I'm not a cryptographer. So I'm honestly asking-- did I solve the corruption-in-transit problem without screwing up anything?

Edit: just to be clear-- I'm not trying to be efficient, or to authenticate, or do anything whatsoever other than a dead simple thing that can be implemented easily.

Edit 2: clarification

not sure; i think this just means the attacker has to guess one letter of the pad in addition to the crib, so (with your example alphabet) they need 26× as many tries to get a corrupted message through