News for hackers. Stuff that matters.
Re:Alternative Internet by peterwwillis on Monday July 08, 2013 @03:53PM (#6008854)
It's not a red herring. I was comparing the commenter's idea that "with enough time you can crack anything" to a system which cannot be cracked and how you wouldn't want to use it for this purpose anyway. I was not attempting to further the understanding of the capabilities of modern cryptography as I don't have all day to sit here and rehash whole textbooks on crypto.

Also, what active adversary are you implying would defeat the one-time pad? Lead pipe cryptography? That pretty much works for everything.

Re:Alternative Internet by mindslight on Monday July 08, 2013 @04:43PM (#6009158)
A one-time pad XORed with a message doesn't provide integrity, and therefore can't reliably secure an arbitrary protocol. An active attacker can easily flip any bit in the message. An easy example would be flipping a debug bit (presumably it started off 0) so that the server responds in plain text. We could blame this weakness on the protocol, but the point is that without message integrity we do not have a solid abstraction to build on top of. Referencing OTPs as unbreakable obscures this and several other problems that modern public key cryptography actually solves.

One-time pads (and all symmetric crypto) can never be user friendly - every pair of parties looking to communicate has to meet in person and exchange keys. Pop references to OTPs create false intuitions that real encryption takes significant work to exchange large eys, only secures preexisting links, and is only ever done by those with super serious secrets (spies, children in treehouses, spies, etc).

Re:Alternative Internet by peterwwillis on Tuesday July 09, 2013 @12:42AM (#6011142)
I also didn't mention the hardware random number generator required to use it properly. Getting a hardware RNG for each machine on the internet is probably more difficult than implementing authentication with OTP. But I did say it was a horrible idea for internet traffic, didn't I? =)

Give me a cryptosystem, and i'll give you a reason nobody should ever use it.