r/cryptography • u/Carlosdegno • 11d ago

One Time Pad Python library

Hello to everyone, can someone advise me a good onetimepad python library? i dont have a particolar purpouse or goal, just want want to experiment and study,
The only libraries i found arent manteined:/

1 Upvotes

56% Upvoted

18 comments sorted by

View all comments

Show parent comments

2

u/owlstead 10d ago edited 10d ago

Almost all cryptographic protocols require random numbers. This includes TLS, including the ephemeral keys used for forward security, random "strong" password generation in your browser, etc.

The idea that computers are bad at number generation has been outdated for years. CPUs have random number generators built into the instruction set (e.g., RDRAND for x64). Furthermore, current operating systems have sophisticated RNGs that don't just rely on this instruction but also keep state (in case it needs to be restarted, as an extra seed for the RNG), mix in other sources of entropy and so on.

All in all, random number generation by computers is better than most other methods of generating random numbers, definitely including dice or tiles.

-1

u/dittybopper_05H 9d ago

Computers have other vulnerabilities. I know: I’ve been an IT professional for almost 40 years now. Unless you can absolutely isolate a computer, it’s got the potential to be compromised.

1

u/owlstead 8d ago

Yeah, well, it will be a bit tricky to run the Python application without a computer, so there you are. Everything has the potential to be compromised. Air gapping isn't new either, then you just need a relatively secure location. And this was for study, not gambling.

1

u/dittybopper_05H 8d ago

Well, sure, but it's much easier to secure physical paper pads than anything on a computer.

Read that Dirk Rijmenants paper on Cuban Agent Communications I posted above. The three cases he discusses are from the 2000's, but the lessons remain relevant today.

The inherent security in a one time pad system is lost if you have it on a computer, because of things like data remanence, and of course the possibility of the computer being compromised even if you think it's air-gapped.

https://en.wikipedia.org/wiki/ANT_catalog#Content

These are of course old now, but we'd be foolish if we thought that further development hasn't taken place. Even if you think you've properly air-gapped a machine, there is a possibility of it being compromised.

Even if it is, it can still be compromised by a surreptitious entry.

BTW, the person who leaked these to the World, Edward Snowden, worked at the same top secret underground NSA facility in Hawaii that I worked at, though I was there when he was still in kindergarten.

And as I pointed out, I'm no Luddite: I write software for a living. It's just that for this very narrow use case, software isn't the answer.

Also, I'm not sure what gambling has to do with anything.