A lot of problems in cryptosystems stem from implementation details - think side-channel attacks, exploits, ...

Don't ask me how Cold War-era NSA discovered that without Cray supercomputers everywhere, but even this scheme is difficult to pull off in practice.

The biggest problem in this mechanism is how does the other party get their one-time pad? An upper bound on the unbreakableness of the entire scheme is the unbreakability of transmitting a one-time pad; and if you can do that, then why not just send the actual message via that mechanism?

Now for 1,2,10 years depending on your rate of communication you can communicate using the one time pad.

>why not just send the actual message via that mechanism?

The point is you only have to exchange pads periodically, not every time you communicate.

My problem is just that the proposed mechanism relies on already having an even more perfect mechanism, and thus cannot be the "only one", but is in fact strictly weaker than this other mechanism. So we have a contradiction, and we can get rid of the notion that there exists such a thing as an "unbreakable" system (or, alternatively, that it is a useful concept)

This is pretty powerful. It means that organization which and periodically move physical assets securely can send information in a manner that is secure even if quantum computers reach their full potential.

Incidentally, the mechanism for sharing the pad doesn't have to be 100% secure, as long as you can reliably detect any compromises. If someone opens the briefcase while it's in transit, you just generate new pads and send another briefcase. To compromise the system, an adversary has to compromise the pad in transit without being detected.

It is the good standard for crypto systems. Yes it's unworkable in practice but that's exactly why nobody really uses it. It is useful for teaching and making comparisons.

Before you send your submarine to sea for example, you can provide them with many gigabytes of one time pad. They can then use this for their most secret communication.

Lots of SSL sessions are going on right now. It only takes a vulnerability like CVE-2014-0160 to change the score by 100 or so.

Briefcases: 1 in the last day

SSL sessions: 100 in the last day

Edit: if only CVE-2014-0160 had some evocative name.

I wouldn't trust some keys that had been lying around on an unencrypted hard drive for 1,2,10 years!

In real-world implementations I think the security is probably based around a large number of men with guns.

Nit: I would consider one time pad to be a method of encryption.

Ah, true. But the encryption algorithm is much simpler to implement than most :-)

If you can, then there's no real need for using a one-time pad. But there's a benefit that comes from a fact that exchanging the random data is a completely separate process in time and space from sending the messages. You can do it once, spending all your resources to secure it. Imagine e.g. two governments establishing a secret emergency line by generating a few terabytes of random data in one physical place and then escorting each copy in armoured trucks to proper communication factilities.

BTW. exchanging physical "XOR's" for one-time pad communication is a plot point of Vernor Vinge's "A Fire Upon the Deep".

1. http://en.wikipedia.org/wiki/One-time_pad#Perfect_secrecy

suppose you can transmit information securely only for some time. Exchange one time pads ahead of time, and use them later to communicate over insecure channel

My only point was that talking about one-time-pads as "unbreakable" encryption is not a useful discussion, since "unbreakable" and "encryption" need to be better defined.

If we expand the definition of "encryption scheme" sufficiently to allow transmission of secrets outside of cryptographic channels, then OTP is not even close to the only unbreakable system.

Only by explicitly defining attack vectors can we really get a good framework for reasoning about cryptography, and even then we know that we can prove an encryption technique is bad. For "goodness", all we can do is increase our confidence, until the day the confidence drops to 0.

Anyway, with this last salvo, I'll retreat from this conversation; it's pretty clear to me that my inane ramblings about semantics are as annoying to the community here as they are to me when other people make them.

No they don't. You are receiving negative feedback because you are trying to adjust definitions that have been well-defined by the crypto community. When talking about the security of an encryption algorithm, the key distribution has absolutely nothing to do with it. Stop conflating the two.

>If we expand the definition of "encryption scheme" sufficiently to allow transmission of secrets outside of cryptographic channels, then OTP is not even close to the only unbreakable system.

Would you care to share with us some of these other unbreakable systems? Remember, the keys are the only thing that can be transmitted outside of the channel and they cannot be based on the information being encrypted.

Any scheme which allows sharing arbitrary amounts of random information is less than or equally secure as an OTP (security defined per symbol) since OTP reveals no information per symbol; also, it uses the minimum amount shared information to do so, provided your symbols are equiprobable.

Technically, either of these could be slightly more secure, in that they need not leak the length of the plaintext. For transmitting a single "yes" vs. "no" answer, that could be a fatal attack vector for a naive OTP.

The known solution to this is to pad messages to some fixed length. The obvious drawback is that you have to choose the fixed length message to be as long as the longest message you may wish to transmit, which could result in having to transmit rather a lot of padding.

The equivalent of this for real-time communications is to transmit continually at a fixed bit rate regardless of whether you have any data to send at any given time.

Send random data that is probably meaningless, until which point you send real data. Let everyone listen in to the gibberish for 50 years, in the end, only the person with the key knows the message.

There is a more general point here, that sometimes seems to be lost in philosophical arguments: reality doesn't pay any attention to the meaning of words. If "unbreakable" is not well-defined (I am not sure that is so), then it is a problem within the domain of language, not cryptography.

For example I may be able to send you a one-time pad securely today, but the message I need to tell you ("buy GM stock at 37.82") I won't know until next week -- at which point I may not be able to expediently send you the one-time pad securely.

...we're not on the modern Internet. I'm looking forward to it; it'll be a better place.