TL;DR
Yes, one-time pads are still used, but rarely in the way most people think. True one-time pad systems are incredibly secure but difficult to implement practically. They’re mainly found in high-security government and military applications where cost isn’t a major concern. More commonly, systems claiming to be ‘one-time pads’ use pseudo-random number generators which significantly weaken security.
What is a One-Time Pad?
A one-time pad (OTP) is theoretically unbreakable if used correctly. It involves these key principles:
- Randomness: The ‘pad’ must be truly random – not predictable.
- Length: The pad must be as long as the message you want to encrypt.
- Single Use: Each pad can only be used once.
Encryption is usually done with a simple XOR operation.
Are True OTPs Common?
No, not really. Here’s why:
- Key Distribution: Securely getting the pad to both sender and receiver is extremely hard. This is often more difficult than securing the message itself!
- Pad Management: Generating, storing, and destroying pads safely is complex.
- Practicality: For large volumes of data, OTPs become unwieldy.
Systems That *Do* Use One-Time Pads
- High-Security Communications: Some governments and military organisations use OTPs for very sensitive communications. Details are rarely public.
- Diplomatic Cables: Historically, some diplomatic services have used OTPs (though modern cryptography is more common now).
Systems That *Claim* to Use One-Time Pads (But Don’t)
Many systems marketed as ‘one-time pads’ are actually using pseudo-random number generators (PRNGs). These aren’t truly random and can be cracked. Here’s how they differ:
- Pseudo-Random vs. True Random: PRNGs create sequences that appear random but are based on an initial ‘seed’ value. If the seed is compromised, the entire sequence is predictable.
- Re-use of Seeds: Some systems re-use seeds or use weak seed generation methods, making them vulnerable.
A simple example of XOR encryption (but not a secure OTP because it uses a fixed key):
python
def xor_encrypt(message, key):
encrypted = ''.join([chr(ord(c1) ^ ord(c2)) for c1, c2 in zip(message, key * (len(message) // len(key) + 1)[:len(message)])])
return encrypted
message = "This is a secret message"
key = "secretkey"
encrypted_message = xor_encrypt(message, key)
print(f"Encrypted: {encrypted_message}"
Notice the key is repeated. This makes it breakable.
How to Identify a Real vs. Fake OTP
- Randomness Testing: A true pad should pass statistical randomness tests (e.g., NIST SP 800-22).
- Key Length: The key must be at least as long as the message.
- Single Use Verification: Confirm that the system prevents re-use of keys.
- Documentation & Audits: Look for independent security audits and clear documentation about the randomness source.
Alternatives to One-Time Pads
For most applications, modern cryptography offers better practicality and security:
- AES (Advanced Encryption Standard): A widely used symmetric encryption algorithm.
- RSA: A common asymmetric encryption algorithm.
- Elliptic Curve Cryptography (ECC): Increasingly popular for its efficiency.
These algorithms are well-studied and have robust implementations available.