THE GARDEN

One-Time Pad

Updated 03 Sep 2026

• •

  Definition

  • •

    the canonical example of a Shannon Cipher — keys, messages, and ciphertexts are all bit strings of the same fixed length $L$

  • •

    encryption: $E(k, m) := k \oplus m$; decryption: $D(k, c) := k \oplus c$ (XOR is its own inverse)

• •

  history

  • •

    due to Gilbert Vernam, 1917 — though there's evidence it was discovered earlier

• •

  variants

  • •

    variable-length one-time pad — keys are a fixed length $L$, but messages/ciphertexts can be any length up to $L$ (using a truncated key); this variant is not perfectly secure, since ciphertext length leaks message length

  • •

    additive one-time pad — defined over $\{0, \ldots, n-1\}$ using addition mod $n$ instead of XOR; still perfectly secure

  • •

    multiplicative one-time pad — defined over $\{1, \ldots, p-1\}$ for prime $p$, using multiplication mod $p$; still perfectly secure

• •

  key result

  • •

    the (fixed-length) one-time pad is a perfectly secure Shannon cipher — for any message and ciphertext, there's exactly one key connecting them

• •

  given message and ciphertext, the key is trivial to recover

  • •

    if you're handed both $m$ and $c = E(k, m)$, the key is simply $k = m \oplus c$ — this is fine (the key was only ever meant to be used once), but it's why key reuse is catastrophic; see Two-Time Pad Attack

• •

  drawback

  • •

    impractical — the key must be as long as the message; see Shannon's Theorem for why this is unavoidable for any perfectly secure cipher

  • •

    if Alice and Bob had a way to securely share a key as long as the message, they could just use that same channel to share the message itself

• •

  no integrity

  • •

    the one-time pad (and stream ciphers generally) provide zero integrity — see Malleability

• •

  related

  • •

    Shannon Cipher

  • •

    Perfect Security

  • •

    Shannon's Theorem

  • •

    Two-Time Pad Attack

  • •

    Malleability

  • •

    Stream Cipher

◌ Explore connections in Graph view