Home > Ask the Security Experts > Platform Security Questions & Answers > A simple substitution cipher vs. one-time pad software
Ask The Security Expert: Questions & Answers
EMAIL THIS

A simple substitution cipher vs. one-time pad software

Michael Cobb, featured expert EXPERT RESPONSE FROM: Michael Cobb, featured expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Enterprise IT tips and expert advice
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


>
QUESTION POSED ON: 23 February 2009
Why is a simple substitution cipher a bad choice for one-time padding?

>
I'm not entirely sure I understand your question, so let's look at what's meant by a simple substitution cipher and then what's meant by a one-time pad or one-time pad software.

In encryption, a substitution cipher replaces units of plaintext with ciphertext according to a regular system. The recipient of the ciphertext can decipher it by performing an inverse substitution. The unit can be anything from a single letter, letters or a mixture of both. Although the plaintext units themselves are altered, they remain in the same sequence in the ciphertext. (This contrasts with a transposition cipher where the units are left unchanged, but their order is rearranged.)

A simple substitution cipher operates on single letters. Using the example below, we can turn the word BADGE into WQRUT in ciphertext:

ABCDEFGHIJ. . .
QWERTYUIOP. . .

The disadvantage of this method is that with any message of reasonable length, fifty letters or more, frequency analysis can be used to deduce the meaning of the most common symbols, allowing a cryptanalyst to build partial words and progressively break the message.

Now, a one-time pad is similar to a substitution cipher, but the plaintext letters are combined not substituted, and it has been proven to be mathematically unbreakable. The recipient of the ciphertext requires a copy of the one-time pad to reverse the process. There are many different ways to apply one-time pads. Here's an example using letters for the one-time pad key:

PlaintextBADGE
10364
OTP KeyQWERT
162241719
Result172272323
CiphertextRWHXX


Using the example above, you take the first letter in the plaintext message and add it to the first random letter from the one-time pad. This number is then converted to the corresponding letter of the alphabet, with the alphabet wrapping around to the beginning if the addition results in a number beyond 26. Using this one-time pad, the word BADGE becomes RWHXX.

Because each one-time pad has a different key, the ciphertext of the word BADGE in this case will be different every time. In the above example, you can also see that frequency analysis is impossible as X occurs for both the letter G and E. With a simple substitution cipher, the word BADGE will always become WQRUT.

The drawbacks with the one-time pad are:

  • The key has to be as long as the plaintext, thus leaking some information about the message.
  • The key has to be genuinely random, which is hard to achieve for large keys.
  • The key can only be used once and must be kept entirely secret from all except the sender and receiver, creating a distribution problem.
If these problems are not overcome, particularly the randomness of the key, the one-time pad is no longer unbreakable. Even if it is theoretically secure, it may be insecure in practice.


BROWSE BY TAG
Platform Security,   Enterprise Data Protection,   Disk Encryption and File Encryption,   VIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google



RELATED CONTENT
Platform Security
Should developers create libraries of common cryptographic algorithms?
How to secure USB ports on Windows machines
What is the best database patch management process?
What is an encryption collision?
What are new and commonly used public-key cryptography algorithms?
Should management processes change based on a patch release schedule?
Does an EULA make it truly illegal to decompile software?
Should businesses delay Windows Vista adoption and just buy Windows 7?
Why should we place data files on a separate partition than the OS?
Should Windows Mobile updates come from Microsoft?

Disk Encryption and File Encryption
Heartland CIO is critical of First Data's credit card tokenization plan
Heartland CIO on end-to-end encryption, credit card tokenization
Should developers create libraries of common cryptographic algorithms?
What is an encryption collision?
Heartland CIO on PCI, E3 project
Visa probes tokens, encryption for PCI card data protection
Voltage, RSA spar over tokenization, data protection
Truth, lies and fiction about encryption
What are new and commonly used public-key cryptography algorithms?
What are the export limitations for AES data encryption?

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
Advanced Encryption Standard  (SearchSecurity.com)
data key  (SearchSecurity.com)
Encrypting File System  (SearchSecurity.com)
encryption  (SearchSecurity.com)
Escrowed Encryption Standard  (SearchSecurity.com)
network encryption  (SearchSecurity.com)
output feedback  (SearchSecurity.com)
Quiz: Cryptography  (SearchSecurity.com)
Rijndael  (SearchSecurity.com)
Twofish  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary



Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Find Security Solutions for Your Business
TechTarget Security Media
Information Security View this month\\'s issue and subscribe today.
Information Security Decisions Apply online for free conference admission.
SearchSecurity.com
HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts