Question 1 of 7: Symmetric Ciphers — One-Time Pad vs. Block Cipher

Question 1: Symmetric Ciphers — One-Time Pad vs. Block Cipher (20 marks)

Question text not reproduced: the examination questions are © Engineers and Geoscientists BC. Open the official past paper (linked at the top of this page) to read the question, then follow the worked solution below.

Part a) — the one-time pad. A one-time pad (OTP) encrypts a plaintext by combining it, bit by bit (or character by character), with a truly random key — the pad — that is at least as long as the message, using a reversible operation such as XOR (or modular addition for text): $C_i = P_i \oplus K_i$. The receiver recovers the plaintext with the identical operation, $P_i = C_i \oplus K_i$, using a copy of the same pad. Three conditions make it secure: the pad must be (1) truly random (not generated by any algorithm/PRNG), (2) at least as long as the plaintext, and (3) used exactly once and then destroyed. When all three hold, Shannon showed the scheme achieves perfect (information-theoretic) secrecy — the ciphertext is statistically independent of the plaintext, so an attacker with unlimited computing power and no knowledge of the key learns nothing about the message from the ciphertext alone; every possible plaintext of that length is equally consistent with the observed ciphertext under some key.

Part b) — block ciphers. A block cipher encrypts a fixed-size block of plaintext (e.g. 64 or 128 bits) at a time under the control of a secret key, using a keyed, invertible transformation built from many rounds of substitution (confusion — obscuring the relationship between key and ciphertext) and permutation/diffusion (spreading each plaintext bit's influence across the whole ciphertext block), most often structured as a Substitution-Permutation Network or a Feistel network. The same key run through the algorithm's rounds in reverse recovers the plaintext. Because real messages are rarely exactly one block long, a mode of operation (e.g. CBC, CTR, GCM) chains successive blocks together, typically with an initialization vector, so that identical plaintext blocks do not produce identical ciphertext blocks. Two common examples: AES (Advanced Encryption Standard, 128-bit blocks, 128/192/256-bit keys, the current U.S. federal standard) and DES/Triple-DES (64-bit blocks; DES's 56-bit key is now considered too short, so 3DES applies it three times with two or three keys).

Part c) — advantage and disadvantage of the OTP versus a block cipher. Advantage: the OTP offers unconditional (information-theoretic) security — its secrecy does not depend on any assumption about an attacker's computing power or on the presumed hardness of a mathematical problem, unlike a block cipher, whose security is only computational (believed hard to break with realistic resources, but not proven unbreakable, and potentially weakened by future cryptanalysis or faster hardware). Disadvantage: the OTP's key must be truly random and as long as the entire message, used only once — for any message traffic beyond a small, occasional exchange, this makes secure key generation, distribution and storage of pads impractical (the key-management problem is at least as hard as protecting the message itself would have been). A block cipher instead reuses a single short key (128–256 bits) across an arbitrarily long message and across many messages, which is what makes it practical for real systems.