One-time pad booster for Internet
One-time pad booster for Internet
Geraldo A. Barbosa∗
QuantaSec – Research in Quantum Cryptography Ltd.,
1558 Portugal Ave., Belo Horizonte MG 31550-000 Brazil.
(Dated: 11 April 2007)
One-time pad encrypted files can be sent through Internet channels using current Internet proto-
cols. However, the need for renewing shared secret keys make this method unpractical. This work
shows how users can use a fast physical random generator based on fluctuations of a light field
and the Internet channel to directly boost key renewals. The transmitted signals are deterministic
but carries imprinted noise that cannot be eliminated by the attacker. Thus, a one-time pad for
Internet can be made practical. Security is achieved without third parties and not relying on the
difficulty of factoring numbers in primes. An informational fragility to be avoided is discussed.
Information-theoretic analysis is presented and bounds for secure operation are determined.
PACS 89.70.+c,05.40.Ca,42.50.Ar,03.67.Dd
Unconditionally secure one-time pad encryption [1] has
not find wide applicability in modern communications.
The difficult for users to share long streams of secret
keys beforehand has been an unsurmountable barrier pre-
venting widespread use of one-time pad systems. Even
beginning with a start sequence of shared secret keys, no
amplification method to obtain new key sequences or key
“refreshing” is available. This work proposes a practical
solution for this problem and discusses its own limita-
tions.
Assume that (statistical) physical noise n = n1, n2, ...
has been added to a message bit sequence X =
x1, x2, ... according to some rule fj(xj , nj) giving Y =
f1(x1, n1), f2(x2, n2), ... (Whenever binary physical sig-
nals are implied, use fj(xj , nj) will represent fj = ⊕
(=addition mod2)). When analog physical signals are
made discrete by analog-to-digital converters, a sum of a
binary signal onto a discrete set will be assumed). The
addition process is performed at the emitter station and
Y becomes a binary file carrying the recorded noise. Y
is sent from user A to user B (or from B to A) through an
insecure channel. The amount of noise is assumed high
and such that without any knowledge beyond Y, neither
B (or A) or an attacker E could extract the sequence X
with a probability P better than the guessing level of
P = (1/2)N , where N is the number of bits.
Assuming that A and B share some knowledge before-
hand, the amount of information between A (or B) and
E differs. Can this information asymmetry be used by A
and B to share secure information over the Internet? It
will be shown that if A and B start sharing a secret key
sequence K0 they may end up with a practical new key
sequence K ≫ K0. The security of this new sequence is
discussed including an avoidable fragility for a-posteriori
attack with a known-plaintext attack. Within bounds
to be demonstrated, this makes one-time pad encryption
practical for fast Internet communications (data, image
or sound). It should be emphasized that being practical
does not imply that K0 or the new keys have to be open
to the attacker after transmission. These keys have to
be kept secret as long as encrypted messages have to be
protected, as in a strict one-time pad. The system gives
users A and B direct control to guarantee secure commu-
nication without use of third parties or certificates. Some
may think of the method as an extra protective layer to
the current Internet encryption protocols. The system
operates on top of all IP layers and does not disturb
current protocols in use by Internet providers. Anyway,
one should emphasize that the proposed method relies on
security created by physical noise and not just on math-
ematical complexities such as the difficulty of factoring
numbers in primes. This way, its security level does not
depend on advances in algorithms or computation.
Random events of physical origin cannot be determin-
istically predicted and sometimes are classified in clas-
sical or quantum events. Some take the point of view
that a recorded classical random event is just the record
of a single realization among all the possible quantum
trajectories possible [2]. These classifications belong to a
philosophical nature, and are not relevant to the practical
aspects to be discussed here. However, what should be
emphasized is that physical noise is completely different
from pseudo noise generated in a deterministic process
(e.g. hardware stream ciphers) because despite any com-
plexity introduced, the deterministic generation mecha-
nism can be searched, eventually discovered and used by
the attacker.
Before introducing the communication protocol to be
used, one should discuss the superposition of physical sig-
nals to deterministic binary signals. Any signal transmit-
ted over Internet is physically prepared to be compatible
with the channel being used. This way, e.g., voltage lev-
els V0 and V1 in a computer may represent bits. These
values may be understood as the simple encoding
V (0) ⇒
V0 → bit 0
V1 → bit 1
Technical noise, e.g. electrical noise, in bit levels V0
and V1 are assumed low. Also, channel noise are as-
sumed with a modest level. Errors caused by these noises
http://arxiv.org/abs/0704.1484v1
are assumed to be possibly corrected by classical error-
correction codes. Anyway, the end user is supposed to
receive the bit sequence X (prepared by a sequence of
V0 and V1) as determined by the sender. If one of these
deterministic binary signals xj is repeated over the chan-
nel, e.g. x1 = x and x2 = x, one has the known prop-
erty x1 ⊕ x2 = 0. This property has to be compared
to cases where a non-negligible amount of physical noise
nj (in analog or a discrete form) has been added to
each emission. Writing y1 = f1(x1, n1) = f1(x, n1) and
y2 = f2(x2, n2) = f2(x, n2) one has f(y1, y2) = neither
0 or 1 in general. This difference from the former case
where x1 ⊕ x2 = 0 emphasizes the uncontrollable effect
of the noise.
The V (0) encoding shown above allows binary values
V0 and V1 to represent bits 0 and 1, respectively. These
values are assumed to be determined without ambiguity.
Instead of this unique encoding consider that two distinct
encodings can be used to represent bits 0 and 1: Either
V (0) over which x
0 and x
1 represent the two bits 0
and 1 respectively, or V (1), over which x
1 = x
0 +ǫ and
0 = x
1 + ǫ (ǫ ≪ 1) represent the two bits 1 or 0 (in
a different order from the former assignment). These en-
codings represent physical signals as, for example, phase
signals.
Assume noiseless transmission signals but where noise
nj has been introduced or added to each j
th bit sent
(This is equivalent to noiseless signals in a noisy channel).
Consider that the user does not know which encoding
V (0) or V (1) was used. With a noise level nj superposed
to signals in V (0) or V (1) and if |x00 − x10| ≫ nj ≫ ǫ, one
cannot distinguish between signals 0 and 1 in V (0) and
V (1) = V (0)+ǫ but one knows easily that a signal belongs
either to the set (0 in V (0) or 1 in V (1)) or to the set
(1 in V (0) or 0 in V (1)). Also note that once the encoding
used is known, there is no question to identify between xj
and xj+ǫ. In this case, it is straightforward to determine
a bit 0 or 1 because values in a single encoding are widely
separated and, therefore, distinguishable. One may say
that without information on the encoding used, the bit
values cannot be determined.
Physical noise processes will be detailed ahead but this
indistinguishability of the signals without basis informa-
tion is the clue for A and B to share random bits over the
Internet in a secure way. Physical noise has been used
before in fiber-optics based systems using M -ry levels [3]
to protect information (αη systems). However, the sys-
tem proposed here is completely distinct from those αη
systems and it is related to the key distribution system
presented in [4].
A brief description of protocol steps will be made, be-
fore a theoretic-security analysis is shown and the sys-
tem’s limitations discussed. It was said that if A and
B start sharing a secret key sequence K0 beforehand
they may end up with a secure fresh key sequence K
much longer than K0 (K ≫ K0). Assume that K0
gives encoding information, that is to say, which encod-
ing (V (0) or V (1)) is being used at the jth emission. As-
sume that K0 = k
1 , k
2 , ... has a length K0 and that
the user A has a physical random generator PhRG able
to generate random bits and noise in continuous levels.
A generates a random sequence K1 = k
1 , k
2 , ...k
(say, binary voltage levels) and a sequence of K0 noisy-
signals n (e.g., voltage levels in a continuum). The de-
terministic signal (carrying recorded noise) Y1 = k
1 , n
1 ), k
2 ⊕f2(k
2 , n
2 ), ... is then sent to B. Is B
able to extract the fresh sequence K1 from Y1? B applies
Y1 ⊕ K0 = f1(k(1)1 , n
1 ), f2(k
2 , n
2 ), ...fN (k
N , n
As B knows the encoding used and the signals rep-
resenting bits 0 or 1 in a given encoding are eas-
ily identifiable: f1(k
1 , n
1 ) → k
1 , f2(k
2 , n
2 ) →
2 , ...fN(k
N , n
N ) → k
N . B then obtains the new ran-
dom sequence K1 generated by A.
Is the attacker also able to extract the same sequence
K1? Actually, this was a one-time pad with K0 with
added noise and, therefore, it is known that the attacker
cannot obtainK1. The security problem arises for further
exchanges of random bits, e.g. if B wants to share further
secret bits with A.
Assume that B also has a physical random genera-
tor PhRG able to generate random bits and noise in
continuous levels. B wants to send in a secure way
a freshly generated key sequence K2 = k
1 , k
1 , ...k
from his PhRG to A. B record the signals Y2 = k
1 , n
2 ), k
2 ⊕ f2(k
2 , n
2 ), ... and sends it to A.
As A knows K1 he(or she) applies Y2⊕K1 and extracts
K2. A and B now share the two new sequences K1 and
K2. For speeding communication, even a simple round-
ing process to the nearest integer would produce a simple
binary output for the operation fj(kj , nj). The security
of this process will be shown ahead.
The simple description presented show a key distribu-
tion from A to B and from B to A, with the net re-
sult that A and B share the fresh sequences K1 and K2.
These steps can be seen as a first distribution cycle. A
could again send another fresh sequence K3 to B and
so on. This repeated procedure provides A and B with
sequences K1,K2,K3,K4, .... This is the basic key dis-
tribution protocol for the system.
A last caveat should be made. Although the key
sharing seems adequate to go without bounds, physical
properties impose some constraints and length limita-
tions. Besides these limitations, the key sequences shared
should pass key reconciliation and privacy amplification
steps [5] to establish security bounds to all possible E
attacks. The length limitation arises from the physical
constraints discussed as follows.
A and B use PhRGs to generate physical signals creat-
ing the random bits that define the key sequences K and
the continuous noise n necessary for the protocol. Be-
ing physical signals, precise variables have to discussed
and the noise source well characterized. Interfaces will
transform the physical signals onto binary sequences ad-
equate for Internet transmission protocols. Optical noise
sources can be chosen for fast speeds. PhRGs have been
discussed in the literature and even commercial ones are
now starting to be available. Without going into details
one could divide the PhRG in two parts, one generating
random binary signals and another providing noise in a
continuous physical variable (e.g., phase of a light field).
These two signals are detected, adequately formatted and
can be added.
Taking the phase of a light field as the physical vari-
able of interest, one could assume laser light in a coherent
state with average number of photons 〈n〉 within one co-
herence time (〈n〉 = |α|2 ≫ 1) and phase φ. Phases
φ = 0 could define the bit 0 while φ = π could de-
fine the bit 1. It can be shown [4] (see also ahead)
that two non-orthogonal states with phases φ1 and φ2
(∆φ12 = |φ1 − φ2| → 0 and 〈n〉 ≫ 1) overlap with (un-
normalized) probability
pu ≃ e−(∆φ12)
2/2σ2
φ , (2)
where σφ =
2/〈n〉 is the standard deviation measure
for the phase fluctuations ∆φ. For distinguishable states,
pu → 0 (no overlap) and for maximum indistinguishabil-
ity pu = 1 (maximum overlap). With adequate format-
ting φ1−φ2 gives the spacing ǫ (∆φ12 = ǫ) already intro-
duced. Eq. (2) with ∆φ12 replaced by ∆φ describes the
probability for generic phase fluctuations ∆φ in a coher-
ent state of constant amplitude (|α| =
〈n〉 =constant)
but with phase fluctuations.
The laser light intensity is adjusted by A (or B) such
that σφ ≫ ∆φ. This guarantees that the recorded infor-
mation in the files to be sent over the open channel is
in a condition such that the recorded light noise makes
the two close levels φ1 and φ2 indistinguishable to the
attacker. In order to avoid the legitimate user to confuse
0s and 1s in a single basis, the light fluctuation should
obey σφ ≪ π/2. These conditions can be summarized as
2/〈n〉 ≫ ∆φ . (3)
This shows that this key distribution system depends fun-
damentally on physical aspects for security and not just
on mathematical complexity.
The separation between bits in the same encoding is
easily carried under condition π/2 ≫
2/〈n〉. The con-
dition
2/〈n〉 ≫ ∆φ implies that that set of bits 0–in
encoding 0, and 1–in encoding 1 (set 1) cannot be easily
identifiable and the same happens with sets of bit 1–in
encoding 0, and bit 0–in encoding 1 (set 2). Therefore,
for A, B and E, there are no difficulty to identify that a
sent signal is in set 1 or 2. However, E does not know the
encoding provided to A or B by their shared knowledge
on the basis used. The question “What is the attacker’s
probability of error in bit identification without repeating
a sent signal?” has a general answer using information
theory applied to a binary identification of two states [6]:
The average probability of error in identifying two states
|ψ0〉 and |ψ1〉 is given by the Helstrom bound [6]
1− |〈ψ0|ψ1〉|2
. (4)
Here |ψ0〉 and |ψ1〉 are coherent states of light [7] with
same amplitude but distinct phases
|ψ〉 = |α〉 = ||α|e−iφ〉 = e− 12 |α|
|n〉 , (5)
defined at the PhRG. |ψ0〉 define states in encoding 0,
where bits 0 and 1 are given by
|ψ0〉 =
|α〉, for bit 0, and
| − α〉, for bit 1 , (6)
|ψ1〉 define states in encoding 1, where bits 1 and 0 are
given by
|ψ1〉 =
||α|e−i
2 〉, for bit 1, and
||α|e−i(
+π)〉, for bit 0 ,
where |φ0 − φ1| = ∆φ. |〈ψ0|ψ1〉|2 is calculated in a
straightforward way and gives
|〈ψ0|ψ1〉|2 = e−2〈n〉[1−cos
] . (8)
For 〈n〉 ≫ 1 and ∆φ≪ 1,
|〈ψ0|ψ1〉|2 ≃ e−
∆φ2 ≡ e−∆φ
2/(2σ2φ) , (9)
where σφ =
2/〈n〉 is the irreducible standard deviation
for the phase fluctuation associated with the laser field.
One should remind that in the proposed system the
measuring procedure is defined by the users A and B and
no attack launched by E can improve the deterministic
signals that were already available to him(her). Thus,
the noise frustrating the attacker’s success, cannot be
eliminated or diminished by measurement techniques.
One should observe that each random bit defining the
key sequence is once sent as a message by A (or B) and
then resent as a key (encoding information) from B (or
A) to A (or B). In both emissions, noise is superposed to
the signals. In general, coherent signal repetitions implies
that a better resolution may be achieved that is propor-
tional to the number of repetitions r. This improvement
in resolution is equivalent to a single measurement with
a signal r × more intense. To correct for this single rep-
etition 〈n〉 is replaced by 2〈n〉 in |〈ψ0|ψ1〉|2. The final
probability of error results
1− e−
. (10)
0.5001
0.5002
0.5003
basesH∆
FIG. 1: ∆Hbases as a function of 〈n〉 and ∆φ.
This error probability can be used to derive some of the
proposed system’s limitations. The attacker’s probability
of success Ps (= 1 − Pe) to obtain the basis used in a
single emission may be used to compare with the a-priori
starting entropy Hbases of the two bases that carry one
bit of the message to be sent (a random bit). If the
attacker knows the basis, the bit will also be known, with
the same probability → 1 as the legitimate user.
Hbases,bit = −p0 log p0 − p1 log p1 = 1 , (11)
where p0 and p1 are the a-priori probabilities for each
basis, p0 = p1 = 1/2, as defined by the PhRG. The en-
tropy defined by success events is Hs = −Ps logPs. The
entropy variation ∆H = Hbases,bit − Hs, statistically
obtained or leaked from bit measurements show the sta-
tistical information acquired by the attacker with respect
to the a-priori starting entropy:
∆Hbases =
Hbases,bit −Hs
. (12)
Fig. 1 shows ∆Hbases for some values of 〈n〉 and ∆φ.
Value ∆Hbases = 1/2 is the limiting case where the two
bases cannot be distinguished. ∆Hbases deviations from
this limiting value of 1/2 indicates that some amount of
information on the basis used may potentially be leaking
to the attacker. It is clear that the attacker cannot obtain
the basis in a bit-by-bit process. In order to be possible
to obtain statistically a good amount of information on
a single one encoding used, L should be given by
∆Hbases −
≫ 1 . (13)
Fig. 2 shows estimates for L for a range of values 〈n〉
and ∆φ satisfying L×
∆Hbases − 12
= 1 (∆φ is given in
powers of 2, indicating bit resolution for analog-to-digital
converters).
It is assumed that error correction codes can correct for
technical errors in the transmission/reception steps for
10000
15000
20000
FIG. 2: Estimates for the minimum length of bits L ex-
changed between A and B that could give one bit of infor-
mation about the bases used to the attacker.
the legitimate users. The leak estimate given by Eq. (13)
do not imply that the information actually has leaked to
the attacker. However, for security reasons, one takes for
granted that this deviation indicate a statistical fraction
of bits acquired by the attacker.
Privacy amplification procedures can be applied to the
shared bits in order to reduce this hypothetical informa-
tion gained by the attacker to negligible levels [5]. These
procedures are beyond the purposes of the present dis-
cussion but one can easily accept that A and B may dis-
card a similar fraction of bits to statistically reduce the
amount of information potentially leaked. Reducing this
fraction of bits after a succession of bits are exchanged
between A and B implies, e.g., that the number of bits to
be exchanged will decrease at every emission. Eventually,
a new shared key K0 has to start the process again to
make the system secure. Nevertheless, the starting key
length K0 was boosted in a secure way. Without further
procedures, the physical noise allowed K ≫ 103K0, a
substantial improvement over the classical one-time pad
factor of 1. One may still argue that the ultimate secu-
rity relies onK0’s length because ifK0 is known no secret
will exist for the attacker. This is also true but does not
invalidate the practical aspect of the system, because the
K0 length can be made sufficiently long to frustrate any
brute-force attack at any stage of technology. Therefore,
the combination of physical noise and complexity makes
this noisy-one-time pad practical for Internet uses.
Although the security of the process has been demon-
strated, one should also point to a fragility of the system
(without a privacy amplification stage) that has to be
avoided when A and B are encrypting messages X be-
tween them. As it was shown, knowledge of one sequence
of random bits lead to the knowledge of the following
sequence. This makes the system vulnerable to know-
plaintext attacks in the following way: E has a perfect
record of both sequences Y1 and Y2 and tries to recover
any bit sequence from them, K2, K1 or K0. E will wait
until A and B uses these sequences for encryption before
trying to brake the system. A and B will encrypt a mes-
sage using a new shared sequence, K1 or K2. This mes-
sage could be a plain-text, say X = x1, x2, ...xK0 known
to the attacker. Encrypting this message with sayK1 in a
noiseless way, gives Y = x1⊕k(1)1 , x2⊕k
2 , ...xK0 ⊕k
Performing the operation Y ⊕ X, E obtains K1. The
chain dependence of Kj on Kj−1 creates this fragility.
Even addition of noise to the encrypted file does not elim-
inate this fragility, because the attacker can use his/her
knowledge of X –as the key– to obtain K–as a message.
The situation is symmetric between B or the attacker:
one that knows the key (X for E, and K for B) obtains
the desired message (K for E, and X for B) [8] .
In general, random generation processes are attractive
to attackers and have to be carefully controlled. Well
identifiable physical components (e.g. PHRG) are usu-
ally a target for attackers that may try to substitute a
true random sequence by pseudo-random bits generated
by a seed key under his/her control. Electronic compo-
nents can also be inserted to perform this task replacing
the original generator; electric or electromagnetic signal
may induce sequences for the attacker and so on. In the
same way, known-plaintext attacks also have to be care-
fully avoided by the legitimate users. The possibility of
further privacy amplification procedures to eliminate the
known-plaintext attack presented is beyond the purposes
of this work.
Many protocols that use secret key sharing may profit
from this one-time pad booster system. For example,
besides data encryption, authentication procedures can
be done by hashing of message files with sequences of
shared secret random bits. Challenge hand-shaking may
allow an user to prove its identity to a second user across
an insecure network.
As a conclusion, it has been shown that Internet users
will succeed in generating and sharing, in a fast way, a
large number of secret keys to be used in one-time-pad
encryption as described. They have to start from a
shared secret sequence of random bits obtained from a
physical random generator hooked to their computers.
The physical noise in the signals openly transmitted
is set to hide the random bits. No intrusion detection
method is necessary. Privacy amplification protocols
eliminate any fraction of information that may have
eventually obtained by the attacker. As the security
is not only based on mathematical complexities but
depend on physical noise, technological advances will
not harm this system. This is then very different from
systems that would rely entirely, say, on the difficulty
of factoring large numbers in their primes. It was then
shown that by sharing secure secret key sequences, one-
time pad encryption over the Internet can be practically
implemented.
∗E-mail: GeraldoABarbosa@hotmail.com
[1] G. S. Vernam, J. Amer. Inst. Elec. Eng. 55, 109 (1926).
C. E. Shannon, Bell Syst. Tech. J. 28, 656 (1949).
[2] V. P. Belavkin, Int. J. of Theoretical Physics 42, 461
(2003).
[3] G. A. Barbosa, E. Corndorf, P. Kumar, H. P. Yuen, Phys.
Rev. Lett. 90, 227901 (2003). E. Corndorf, G. A. Bar-
bosa, C. Liang, H. P. Yuen, P. Kumar, Opt. Lett. 28,
2040 (2003). G. A. Barbosa, E. Corndorf, and P. Ku-
mar, Quantum Electronics and Laser Science Conference,
OSA Technical Digest 74, 189 (2002).
[4] G. A. Barbosa, Phys. Rev. A 68, 052307 (2003); Phys.
Review A 71, 062333 (2005); quant-ph/0607093 v2 16
Aug 2006.
[5] S. Wolf, Information-Theoretically and Computationally
Secure Key Agreement in Cryptography, PhD thesis,
ETH Zurich 1999.
[6] C. W. Helstrom, Quantum Detection and Estimation
Theory, ed. R. Bellman (Academic Press, 1976), pg. 113
Eq. (2.34).
[7] R. J. Glauber, Phys. Rev. 130, 2529 (1963); Phys. Rev.
131, 2766 (1963); Quantum Optics and Electronics, eds.
C. DeWitt, A. Blandin, C. Cohen-Tannoudji (Dunod,
Paris 1964), Proc. École d’Été de Physique Théorique de
Les Houches, 1964.
[8] The author thanks one of the reviewers for a demonstra-
tion of this fragility.
http://arxiv.org/abs/quant-ph/0607093
