Perfect Secrecy: A Mathematical Guarantee
In 1949, Claude Shannon — the father of information theory — proved something remarkable: the one-time pad provides perfect secrecy. This means that the ciphertext reveals absolutely zero information about the plaintext, even to an adversary with unlimited computational power. No other practical encryption system makes this claim. AES, RSA, and every modern cipher are computationally secure — they rely on problems being 'hard enough' to solve. The one-time pad is information-theoretically secure: there is literally not enough information in the ciphertext to determine the message.
The XOR Operation
The one-time pad works through XOR (exclusive or), the simplest binary operation. For each bit of the message, XOR it with the corresponding bit of the key: 0⊕0=0, 0⊕1=1, 1⊕0=1, 1⊕1=0. If the key is truly random, each ciphertext bit is equally likely to be 0 or 1, regardless of the message bit. This is why it's perfectly secure: the ciphertext is statistically indistinguishable from random noise. To decrypt, simply XOR the ciphertext with the same key — XOR is its own inverse: (M ⊕ K) ⊕ K = M.
Why Key Reuse Destroys Security
The 'one-time' in one-time pad is not a suggestion — it's a requirement. If the same key encrypts two different messages, an eavesdropper can XOR the two ciphertexts: C1 ⊕ C2 = (M1 ⊕ K) ⊕ (M2 ⊕ K) = M1 ⊕ M2. The key cancels out, revealing the XOR of the two plaintexts. From this, statistical techniques (like frequency analysis on the XOR pattern) can recover both messages. The US VENONA project exploited exactly this flaw: Soviet intelligence accidentally reused one-time pad pages, allowing American cryptanalysts to decrypt thousands of messages over decades.
The Practical Paradox
If the one-time pad is unbreakable, why don't we use it for everything? Because the key must be at least as long as the message, truly random (not pseudorandom), and used only once. To encrypt a 1GB file, you need 1GB of random key material. To encrypt all internet traffic, you'd need a key as long as all internet traffic. And you need a secure channel to transmit these keys — the very problem encryption is supposed to solve. This chicken-and-egg dilemma is why we use computationally secure ciphers (like AES) for most purposes, reserving the one-time pad for the most sensitive communications where key distribution is manageable.