The One-Time Pad

The One-Time Pad: The Only Unbreakable Cipher in This Series

Introduction

Every classic cipher covered in this series (Caesar, Vigenère, Beaufort, Autokey, ADFGVX, all of them) is breakable, given enough ciphertext and effort. The one-time pad is the single exception. It is not merely hard to break; it is mathematically proven to be unbreakable, in a precise, formal sense established by Claude Shannon in 1949. The catch is that achieving this perfect security requires satisfying three conditions so demanding that, in nearly a century of trying, real-world systems have almost never managed to meet all three at once.

Table of Contents

• How the One-Time Pad Works
• A Worked Example
• The Three Conditions for Perfect Secrecy
• Why It’s Provably Unbreakable
• One-Time Pad vs. Vigenère vs. Autokey
• Pros and Cons Analysis
• Why the One-Time Pad Almost Never Gets Used Correctly
• Modern Relevance
• Python Implementation
• Limitations
• Conclusion
• FAQ
• References

How the One-Time Pad Works

Mechanically, the one-time pad is identical to Vigenère: each plaintext letter is combined with a key letter using addition modulo 26, C = (P + K) mod 26. What makes it a one-time pad rather than “Vigenère with a longer keyword” is entirely about the nature of the key itself:

1. The key must be truly random: not a word, not a phrase, not anything generated by a predictable process.
2. The key must be at least as long as the message: no repeating, no cycling back to the beginning.
3. The key must be used exactly once, and then permanently destroyed.

A fourth condition is sometimes listed explicitly in formal treatments: the key must be kept completely secret, known only to the sender and intended recipient. It’s implicit in the three above: a leaked key defeats any cipher, one-time pad included. But it’s worth naming directly, since it’s just as absolute a requirement as the other three. There’s no partial credit for “mostly secret.”

This letter-based, modulo-26 version is used throughout this series for consistency with every other cipher covered. But the same idea works identically in binary. Modern one-time-pad implementations typically XOR the message’s bits directly with a truly random key of matching bit-length, rather than adding letter positions mod 26. XOR is simply modular addition in base 2 (mod 2 instead of mod 26), so it’s the exact same mathematical idea, just applied to bits instead of letters.

Interactive Visualizer

Try it above with the default key “XMCKL”, a key exactly as long as the default plaintext “HELLO”. Click “Generate Random Key” to see a fresh, correctly-sized random key produced on demand, exactly as a real one-time pad system would require for every new message.

A Worked Example

Using plaintext “HELLO” and the (illustrative) random key “XMCKL”, exactly 5 letters, matching the plaintext’s length:

Plain (P)	H	E	L	L	O
Key (K)	X	M	C	K	L
Result	E	Q	N	V	Z

For the first letter: P=H (7), K=X (23), so C = (7 + 23) mod 26 = 30 mod 26 = 4 → E.

“HELLO” → “EQNVZ”

Decryption subtracts the same key: P = (C - K) mod 26, recovering “HELLO” exactly, provided the recipient has that exact same random key.

Cipher (C)	E	Q	N	V	Z
Key (K)	X	M	C	K	L
Result	H	E	L	L	O

For the first letter: C=E (4), K=X (23), so P = (4 - 23) mod 26 = -19 mod 26 = 7 → H, matching the original plaintext exactly.

The Three Conditions for Perfect Secrecy

Each of the three requirements closes off a specific avenue of attack that works against every other cipher in this series:

• True randomness defeats any attack that exploits key predictability. There’s no keyword to guess, no pattern to search for, because the key isn’t generated by any process an attacker could model or predict. This means information-theoretically random: every possible key of the required length must be equally likely, with no bias or correlation whatsoever. It is not merely a key that “looks random” to a human eye, and not a key produced by a pseudorandom number generator (PRNG). A PRNG, no matter how good it looks statistically, is still a deterministic algorithm running from a fixed seed. An attacker who identifies the algorithm and recovers or guesses the seed can reproduce the entire “random” key stream. That’s exactly the kind of predictability this condition is meant to rule out.
• Key length matching the message defeats Kasiski examination and every other attack that relies on a repeating key creating periodic structure: there is no period, because the key never repeats within a single message.
• Single use, then destruction defeats attacks that compare multiple messages encrypted under the same key (a technique that, in practice, has broken real-world “one-time” pad systems that were reused, most famously in Soviet Venona-era traffic, decades later).

Why It’s Provably Unbreakable

This is the one-time pad’s genuinely remarkable property: when all three conditions hold, every possible plaintext of the correct length is equally likely to have produced any given ciphertext. For “EQNVZ”, an attacker with unlimited computing power, trying every conceivable 5-letter key, would find that every possible 5-letter message (“HELLO”, “WORLD”, “PIZZA”, anything) is produced by some key. Without additional information, there is no mathematical basis whatsoever for preferring one candidate plaintext over another. This is what Claude Shannon formally defined as perfect secrecy: the ciphertext provides zero information about the plaintext, in the strict information-theoretic sense.

Concretely: the key “XMCKL” decrypts “EQNVZ” to “HELLO,” as shown above. But the key “ICWKW” decrypts that exact same “EQNVZ” to “WORLD” instead, equally validly, with no arithmetic error anywhere. Both keys are five letters, both are perfectly plausible truly-random strings, and both produce a coherent English word. An attacker staring at “EQNVZ” alone has no way to determine which of these (or the countless other 5-letter keys producing other 5-letter messages) is the real one. The ciphertext simply doesn’t encode enough information to distinguish them.

This is fundamentally different from every other cipher in this series being merely computationally hard to break. Modern ciphers like AES are secure because breaking them would take longer than the age of the universe with current technology. But they’re not proven unbreakable, and a sufficiently clever mathematical breakthrough (or a future quantum computer, for some algorithms) could in principle change that. The one-time pad’s security doesn’t depend on any assumption about computational difficulty at all.

One-Time Pad vs. Vigenère vs. Autokey

Seeing these three side by side clarifies exactly what each innovation bought, and what each still lacked:

• Vigenère: repeating keyword, far shorter than the message, vulnerable to Kasiski examination once the (short) period is found.
• Autokey: key extended using the message itself, eliminating the repeating period, but the key still isn’t random (it’s built from ordinary language, which carries exploitable statistical structure).
• One-time pad: key as long as the message and truly random, eliminating both weaknesses simultaneously and achieving actual proven security rather than just closing one specific attack avenue.

The one-time pad is, in a real sense, the logical endpoint of the entire “make the key less predictable and less repetitive” progression this series has traced from Vigenère through Beaufort and Autokey.

Pros and Cons Analysis

Advantages	Disadvantages
Mathematically Proven Unbreakable: Not “hard to break”: genuinely, provably impossible to break, given correct use	Key Distribution Problem: The key is as large as the entire message, and it must reach the recipient through some channel at least as secure as the one you’re trying to protect, which is a circular problem
No Computational Assumptions: Security doesn’t rely on any algorithm being hard to compute, unlike every modern cipher including AES and RSA	Impossible to Reuse or Compress: Every single message needs its own fresh, full-length random key; there’s no way to “stretch” a shorter secret to cover more traffic
Conceptually Simple: The encryption operation itself is just addition modulo 26: no complex mathematics required to understand or implement correctly	Key Storage and Destruction: Both parties must securely store a large volume of random key material and reliably destroy each portion after use, a real operational security challenge
A Genuine Theoretical Landmark: The formal basis (Claude Shannon’s 1949 paper) for the entire modern field of information-theoretic cryptography	No Integrity Protection: A one-time pad, used correctly, guarantees confidentiality but says nothing about whether a message was tampered with; an attacker who knows or guesses part of a message can flip specific bits in the ciphertext to change it undetected

Why the One-Time Pad Almost Never Gets Used Correctly

The one-time pad’s Achilles’ heel isn’t cryptographic: it’s logistical. Generating enough genuinely random key material to cover all communication, distributing it securely in advance (since the key itself needs protecting at least as strongly as the message), and guaranteeing it’s never reused, are extraordinarily difficult at any real-world scale:

• True randomness is hard to generate reliably. Historically, some “one-time pad” systems used flawed random-number generation that turned out to be predictable, undermining the entire security guarantee.
• Key material equal in size to all your traffic is a massive logistics burden: physically transporting, securely storing, and provably destroying pads was a serious operational challenge for the intelligence agencies and diplomatic services that actually used one-time pads historically.
• Reuse under pressure has happened in practice. Wartime resource constraints famously led to some Soviet cryptographic material being reused. Decades later, that let the American Venona project partially decrypt intercepted traffic that should have been theoretically unbreakable.
• Proving non-reuse is itself an unsolved operational problem. Even with the best intentions, there’s no cryptographic way to verify after the fact that a given pad was genuinely used only once and properly destroyed rather than copied, backed up, or reissued under pressure. An organization has to rely entirely on procedural discipline and trust, with no mathematical check available. That’s precisely the kind of soft spot that undermined Soviet operational security during the Venona era.

Modern Relevance

The one-time pad has essentially no direct modern application at internet scale: its key-distribution requirements make it impractical for anything beyond very low-volume, extremely high-value communication (some diplomatic and intelligence channels have reportedly used true one-time pads for exactly this reason). But its theoretical legacy is foundational:

• It defines the gold standard against which every other cipher’s security is implicitly measured: “perfect secrecy” versus “computational security.”
• It directly motivated stream cipher design: modern stream ciphers (like ChaCha20) generate a long pseudorandom keystream from a short secret seed, using a cryptographically secure pseudorandom generator instead of true randomness. They deliberately try to approximate one-time-pad-style security, trading proven perfect secrecy for practical key management.
• Quantum Key Distribution protocols aim to solve exactly the one-time pad’s core weakness: secure key distribution. They use quantum mechanics to detect eavesdropping, specifically so that one-time-pad-style perfect secrecy becomes practical for at least some high-value links.

Python Implementation

Mechanically this is identical to Vigenère’s (P + K) mod 26; the code below adds a key-length check and a way to generate a fresh key, since those are exactly the properties that make a pad a pad rather than a repeating keyword:

import secrets
import string

def generate_random_key(length):
    """A fresh key, exactly this long, meant to be used once and then destroyed."""
    return ''.join(secrets.choice(string.ascii_uppercase) for _ in range(length))

def otp_transform(text, key, mode="encrypt"):
    text = ''.join(c for c in text.upper() if c.isalpha())
    key = ''.join(c for c in key.upper() if c.isalpha())
    if len(key) < len(text):
        raise ValueError("key must be at least as long as the message")
    result = ''
    for i, char in enumerate(text):
        p = ord(char) - ord('A')
        k = ord(key[i]) - ord('A')
        shifted = (p + k) % 26 if mode == "encrypt" else (p - k) % 26
        result += chr(shifted + ord('A'))
    return result

if __name__ == "__main__":
    plaintext = "HELLO"
    key = "XMCKL"  # the illustrative key from the worked example above

    ciphertext = otp_transform(plaintext, key, "encrypt")
    recovered = otp_transform(ciphertext, key, "decrypt")

    print(f"Plaintext:  {plaintext}")
    print(f"Ciphertext: {ciphertext}")
    print(f"Recovered:  {recovered}")

    fresh_key = generate_random_key(len(plaintext))
    print(f"\nA real pad never reuses a key. Next message needs a new one, e.g.: {fresh_key}")

This reproduces the worked example above exactly: HELLO → EQNVZ → HELLO. The if len(key) < len(text) check exists specifically to catch the single most common way this cipher gets misused: reusing or truncating a key that’s shorter than the message.

Limitations

This implementation demonstrates the mechanism; it doesn’t, and can’t, guarantee correct real-world usage:

• secrets.choice is not the same as true randomness. It’s a cryptographically secure pseudorandom generator, suitable for real cryptographic key generation in a way random.choice would not be. But as the Three Conditions section above explains, a one-time pad’s proof of perfect secrecy specifically requires information-theoretically true randomness, not merely output that passes statistical tests. This is a genuine, unavoidable gap between what software can practically provide and what the mathematical proof assumes.
• Nothing enforces single-use. The code raises an error if the key is too short, but nothing stops a caller from accidentally calling otp_transform twice with the same key, which (as the Why It’s Provably Unbreakable section notes) is exactly the mistake that undermined the real Venona-era pads.
• English letters only, formatting is lost. Spaces, punctuation, and case are stripped before the transform runs, same as Vigenère.
• No key distribution or destruction mechanism. As the Why the One-Time Pad Almost Never Gets Used Correctly section explains, generating a correct key is the easy part; this code has no way to help with the genuinely hard logistics problems of secure delivery and provable destruction.

Conclusion

The one-time pad closes out this series’ progression through classic ciphers with the one entry that isn’t just “eventually breakable with enough effort.” It’s the single cipher genuinely proven, mathematically, to leak zero information about its plaintext when used correctly. That proof is real and profound; it’s also precisely why the one-time pad remains, nearly a century after Shannon formalized its security, a footnote in practical cryptography rather than its foundation. Every modern cipher this series has referenced (AES, ChaCha20, RSA) represents a deliberate, pragmatic trade: accepting merely computational security in exchange for keys that are actually short enough, and reusable enough, to build a working communication system around.

FAQ

What is the one-time pad?

A cipher that combines each plaintext letter with a key letter via modular addition, exactly like Vigenère, but where the key must be truly random, exactly as long as the message, and used only once before being destroyed.

Why is the one-time pad considered unbreakable?

Because when its three conditions are met, every possible plaintext of the correct length is equally consistent with any given ciphertext. There’s no statistical or structural basis for an attacker to prefer one candidate plaintext over another, even with unlimited computing power. Claude Shannon formally proved this property, called perfect secrecy, in 1949.

If it’s unbreakable, why isn’t the one-time pad used everywhere?

Because its key must be as long as the total volume of all messages ever sent, must be truly random, and must be securely distributed to both parties in advance. That is a logistics problem that scales terribly and has historically been the actual point of failure, not the mathematics.

What happens if a one-time pad key is reused?

Reuse destroys the security guarantee entirely. Comparing two ciphertexts encrypted under the same key reveals information about the relationship between the two plaintexts (their XOR, effectively). Real-world cryptanalysis has exploited exactly that, including the historical Venona project against reused Soviet key material, to partially recover supposedly unbreakable messages.

How does the one-time pad relate to modern encryption like AES?

AES and other modern ciphers deliberately trade the one-time pad’s proven, unconditional security for practicality: a short, reusable key expands into a long pseudorandom keystream (or equivalent transformation) that’s merely computationally infeasible to break, not mathematically proven impossible. That trade-off makes real-world systems actually usable.

References

1. Shannon, C. E. “Communication Theory of Secrecy Systems.” Bell System Technical Journal, 1949.

2. Wikipedia. “One-time pad.” Available at: https://en.wikipedia.org/wiki/One-time_pad

3. National Security Agency. “The Venona Project.” Available at: https://www.nsa.gov/history/cryptologic-history/historical-figures-publications/venona/

4. Singh, Simon. “The Code Book.” Doubleday, 1999.