Slashdot Mirror
Totally Random One Time Pads
liliafan writes "Scientists in Japan have come up with a way of harnessing a truly random datasource for generating one time encryption pads: Quasars. One time encryption pads are widely accepted as being the most secure form of encryption, but this new technology from the National Institute of Information and Communications Technology makes the pads even more secure."
This is a dupe of almost the same story from the same source.
From what I hear, I'll probably be able to save on my heating bills too.
><));>
Women have had those forever...
if this is ever widely accepted, it seems that the inevitable deluge of security researchers trying to find predictability in the patterns would be a beneficial thing. if one ever comes close to succeeding, sure your credit card details could be stolen, but we'd understand the universe a tiny little bit better...
An old-timer with old-timey ideas.
Getting randomness isn't interesting. Thermal noise is truly random, perfectly white, and easy to generate---it's as hard as passing a current through a resistor. Want more noise power? Avalanche breakdown, with appropriate whitening, works fine.
Unless they've come up with an interesting way for two people in disparate locations to observe the same quasar and both independently observe the same random phenomena in a way which reliably and securely gives them access to the pad with no communication channel between them, this just isn't interesting.
-rsw
i147 F7b AIQzC9 7kXTA8TzJ Vl LcYxkN FXkCFA Ev4Lpwjk2 A0Jy7flvj phOlaTF 3S Z0uPk kP 5RKMkQ 5U5oZPW FzA f rj4FB 4vrI ZWr dovA6W l CS6
The sea changes color, but the sea does not change.
I imagine someone who wanted to could buy enough equiptment to record all known quasar emmissions and store them
or try them against encrypted data streams. A million quasars with 5000 possible frequencies each, wouldn't be that
much for a computer to churn thru. In a way, it almost seems like security thru obscurity.
The summary for this article is a little misleading. One time pads aren't new, and good sources of natural randomness aren't new either.
The interesting part of this article is the fact that quasars could be used as a natural source of randomness for one time pads, yet can be accessed by both parties simultaneously. The historical problem with one time pads (and the reason they're rarely used in practice) is that it's a huge pain to distibute sufficient random data to all parties involved in a communication. Being able to use a natural source of randomness that's available to everyone at once would be a major increase in the usability of one time pads.
It sounds like a great idea, but it might be easy to subvert. All I have to do is overwhelm the signal and get the target to use my (or null) one time pad, and I will be able to decrypt. Hell I can even make my one time pad *look* random, and they'd likely never notice. While I'm at it I can do it from a satellite and not have to get near their antenna.
Im not here now... Im out KILLING pepperoni
...harnessing a truly random datasource
Wow, they finally managed to tap into my girlfriend's mood neurons?
[alk]
How does this increase security? It's not like quasars are private property. Anyone can look at 'em...
How is this more secure than one-time pads? Whereas only the two parties involved have access to one-time pads, everyone has access to quasar radiation. The two users still have to tell eachother where to look and when, and that information is all someone would need to crack the message. The only way it could be more secure is if the coordinates are only available on one-time pads, in which case you're basically saying that code breakers have to go out and buy an antenna....
That's not randomness at all. It only seems random because they don't have a model currently to describe quasar behavior. Thus, they're confusing randomness with unpredictability - just because one can't predict what will happen in the next n instances doesn't make it random. What's to say some brilliant scientist won't come along in the near future with a model predicting quasar behavior?
Intergalactic Public Key Infrastructure
Naah. Just prevent everyone except the intended recipient from knowing when you're recording it for the OTP. Much easier problem.
My blog. Good stuff (when I remember to update it). Read it.
One Time Pads may be the most secure form of encryption, but they are *not* the most secure way to protect your secrets.
Time and time again, security breaks down because of the way people treat their keys, not because the encryption algorithm is week.
With a one time pad, you need to keep a copy of the pad with everyone who wants access to the data. Compare that to Public Key Crypto where you can keep your private key in one secure spot and distribute your public key widely.
Or how about session keys (Diffie Hellman for example)... single use keys that only you and your partner have access to. How good is that! And you don't need to transfer and secure your OTP to use them!
In order for an intelligence agency to communicate with an asset overseas, spy agencies must often use methods of communication that cannot be easily traced (duh). Passing a message along via e-mail, phone, or a one-to-one meeting can easily be tracked, creating lots of problems for everyone in the loop.
Therefore, many intelligence agencies did (and still) use OTPs and "Numbers Stations" - shortwave radio stations that blast out a seemingly senseless series of numbers at regular intervals and frequencies. This method gets messages and instructions to your assets without betraying who the recipient of the message is.
The beauty is that the asset only needs a cheap, readily available shortwave radio and a OTP, which can be concealed in virtually anything (some were created that could even be affixed to the back of stamps, others were hidden in toothpaste tubes, etc. The agent then responds with a seemingly inocuous method, a "wrong number code", a mark on a wall near where an intelligence officer drives, etc.
The problem, of course, rests in getting OTPs to the asset and ensuring they aren't compromised. But, assuming they are passed and handled securely, there's no problem at all.
More information on Wikipedia
The fundimental problem is that the data is not fully random -- it is mostly deterministic based on the key of what quasar, what frequency and bandwidth, and what time. So an outside person could recover the plaintext by obtaining the observable behavior and trying all keys, or if the outside person could somehow obtain the key.
This is a very similar situation to a "good" pseudorandom number generator. You can transmit the seed for the pseudorandom number generator and generate a one-time pad from the pseudorandom number generator. I guess the difference is that quasar behavior is not observable after the fact, but if it is feasable for the data to be logged then they reduce to similar solutions: find all the pads within the keyspace, xor with the cipher text, and watch for the entropy to drop or visibility of known plaintext.
-- Erich
Slashdot reader since 1997
If the party trying to decrypt your message knows that your "random" data comes from a quasar, they could just monitor the quasar themselves and crack the data pretty quickly (faster than brute force). Cryptography relies on the random data being secret, and this isn't secret at all unless your trying to hide your conversation from someone whose planet can't view the quasar you're using.
"O'Connor, smash the window." "Why me, Bigboote?" "It might be boobie-trapped!" "Oh!"<smash> -Buckaroo Banzai
This is a Vernam Cipher with a novel but impractical noise source. It was news when Vernam invented it in 1917, and maybe again in 1919 when he patented it, but this version solves an already-solved problem in a manner that would sound really good if Lt. Colonel Carter suggested it on SG-1, but otherwise is inferior to existing solutions to the same problem.
Nothing to see here, folks; move along.
Time to check the prescription on your reading glasses there Pops.
"One time encryption pads are widely accepted as being the most secure form of encryption..."
Only for very limited definitions of secure. You have to produce the pads. You have to distribute the pads. You have to synchronize the pads. You have to dispose of the pads. All these steps are tedious and error-prone, and a chink in any of them destroys your supposed "perfect" security.
Now if you said "OTP are the most algorithmically secure pads under ideal conditions", then I'd buy it. Otherwise, there's a reason only well-funded governments use these things. Ask the Soviets how well it worked for them.
Democracy is two wolves and a sheep voting on lunch.
So you get to go home to a different apartment each night?
Cool! But how do you move all your stuff from place to place?
wbs.
Huh?
Agencies like the NSA will just monitor all quasars all the time. Given that the NSA already monitors (and records) communications transmissions (wireless mostly) 24/7/365.25, matching a quasar from the database with the appropriate signal start and stop would not be difficult to do. I'd say, not very secure a system really, because if the data is coming to or going from the U.S. the quasar would have to be visible in the same hemisphere as it's destination. You could not use this scheme to transmit data to the other side of the world either, as you would need the quasar to be visible by both parties. I'm still not that impressed. It's nice, but I really don't think it's more secure than much of what is out there already for crypto techniques.
The idea of making a one time pad out of a universally available information resource just seems real silly. It may be the easiest, highest volume, highest quality source of random data, but we have already in the past see ideas like large key space and computational complexity fall to one advance or another. It strikes me that even if there are 80,000 sources in the sky, that can be narrowed down quite a bit if you just look at the direction they are pointing their radio telescopes. Or are they using some secret hidden radio telescopes to capture quasar data? There may be some small ones but I think most are really, really big. You could probably tell the angle they are pointed at from a satellite. Also, if this encryption method gets used a lot you have to expect that more information about the route the data takes gets known. It seems to me there are a more limited number of radio telescopes with this system installed than there are say labs with a more traditional random data generator.
... on the list of snake-oil warning signs.
http://outcampaign.org/
Hmmm. Generate a random integer between 1 and 3 inclusive.
This must be done with a finite number of coin tosses.
The probability of each integer occuring must be equal.