Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

When we start shipping revokable 64gb compressed one time pad data sticks, I'll have some faith in crypto.

Until then, one eye always open.



If it can be compressed, you should probably not trust your pad ;)


I think the motivation behind RSA tokens is that while you can steal them, you shouldn't be able to silently copy one. That's not something you get with an OTP on a USB stick, unless you invest into tamper-proof hardware.

Aside from that, I'm not sure why OTPs aren't more commonly used. They're easy to reason about, and while you still need some protocol to use them correctly, it would seem that protocol would be much simpler than for fancy crypto like RSA.


The "some protocol to use them" part is where the crypto in the hardware devices in this attack fell down, which is one of the many reasons people don't use OTPs: they shift all of the security of the system from the cryptographic algorithm itself to the protocol, which is the most error-prone part of the system.

Neither RSA nor AES were damaged by this attack.


You would need a OTP for every one you wanted to talk to. If I had a OTP for every https site I visit, I'd need hundreds. Facebook would need hundreds of millions. They're not going to be mailing out USB sticks on a weekly basis.


You need an RSA token for each server you talk to as well. It's not a replacement for asymmetric cryptography.


You'd "need" (in the handwaviest sense, because nobody had designed a crypto token based on one-time pads here) OTP content for every authentication attempt.


"They're not going to be mailing out USB sticks on a weekly basis"

Mailing? That's not secure enough.. You have to go to Facebook HQ and get your weekly OTP. Daily if you post a lot of images =)




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: