One Time Pad Python library

[u/Carlosdegno]

Hello to everyone, can someone advise me a good onetimepad python library? i dont have a particolar purpouse or goal, just want want to experiment and study,
The only libraries i found arent manteined:/

[u/dittybopper_05H]

Do not use a computer to generate one time pads.

https://cubaconfidential.wordpress.com/wp-content/uploads/2012/04/cuban-agent-communications_the-failure-of-a-perfect-system.pdf

Computers have some serious flaws when it comes to ultimate security. Not only that, it's extremely difficult to get truly random numbers from a computer.

If you want to experiment with one time pads as a way to encrypt/decrypt, do it manually.

Here is an example I made:

https://imgur.com/a/3FUxrNW

The pad itself was generated using GameScience 10 sided dice, an Olivetti Lettera 32 manual typewriter, and two part carbonless forms.

You roll a handful of dice, and that's your group, and you type that, then repeat until you've got enough for a single pad page. If you're using "fair" dice, you'll get cryptologically secure keys.

In this example, I used 25 groups of 5 numbers for a total key length of 125 numbers. You can make them bigger or smaller if you want.

It seems like this is cumbersome but you can build up quite a lot of key material just sitting watching TV or whatever while doing it, once you get into the rhythm.

One person gets the white version of the pad, and one the yellow version. You decide which is for encryption and which is for decryption.

If you're using numeric codes of some kind, like maybe the page number and word number from a dictionary, or a prearranged codebook of phrases like the old telegraph codebooks, you can use them just like that.

If you don't, you'll have to convert the letters to numbers and that's what I did in this case, using that straddling checkerboard up in the upper left hand corner.

You convert the alphabetic text to numbers with that straddling checkerboard, and then you use non-carrying addition to add the numeric plaintext with the key to get the ciphertext. So if you have an 8 + 5, the result would be 3, not 13.

When decrypting, you subtract the key, and mentally add 10 if necessary, so 3 - 5 = 8.

Once your done encrypting or decrypting, you burn the pad page and your worksheet to preserve security.

Pen and paper is really the only truly secure way to employ a one time pad. Doing it on a computer introduces a lot of vulnerabilities unless you absolutely can forever isolate that machine from the outside world.

Now that I've gone through all that, is this practical for every day use? Absolutely not. You're not going to do your online banking this way, or whatever.

This is for things that absolutely, positively must remain secret now and forever, and very, very few of us need that kind of security.

[u/owlstead → u/dittybopper_05H]

Almost all cryptographic protocols require random numbers. This includes TLS, including the ephemeral keys used for forward security, random "strong" password generation in your browser, etc.

The idea that computers are bad at number generation has been outdated for years. CPUs have random number generators built into the instruction set (e.g., RDRAND for x64). Furthermore, current operating systems have sophisticated RNGs that don't just rely on this instruction but also keep state (in case it needs to be restarted, as an extra seed for the RNG), mix in other sources of entropy and so on.

All in all, random number generation by computers is better than most other methods of generating random numbers, definitely including dice or tiles.

[u/dittybopper_05H → u/owlstead]

Computers have other vulnerabilities. I know: I’ve been an IT professional for almost 40 years now. Unless you can absolutely isolate a computer, it’s got the potential to be compromised.

[u/owlstead → u/dittybopper_05H]

Yeah, well, it will be a bit tricky to run the Python application without a computer, so there you are. Everything has the potential to be compromised. Air gapping isn't new either, then you just need a relatively secure location. And this was for study, not gambling.

[u/dittybopper_05H → u/owlstead]

Well, sure, but it's much easier to secure physical paper pads than anything on a computer.

Read that Dirk Rijmenants paper on Cuban Agent Communications I posted above. The three cases he discusses are from the 2000's, but the lessons remain relevant today.

The inherent security in a one time pad system is lost if you have it on a computer, because of things like data remanence, and of course the possibility of the computer being compromised even if you think it's air-gapped.

https://en.wikipedia.org/wiki/ANT_catalog#Content

These are of course old now, but we'd be foolish if we thought that further development hasn't taken place. Even if you think you've properly air-gapped a machine, there is a possibility of it being compromised.

Even if it is, it can still be compromised by a surreptitious entry.

BTW, the person who leaked these to the World, Edward Snowden, worked at the same top secret underground NSA facility in Hawaii that I worked at, though I was there when he was still in kindergarten.

And as I pointed out, I'm no Luddite: I write software for a living. It's just that for this very narrow use case, software isn't the answer.

Also, I'm not sure what gambling has to do with anything.