-: Every encryption cipher is attempting to do
one basic function.
We're trying to assure you that confidentiality exists
in the data they've encrypted.
But, no encryption cipher is truly unbreakable.
Given enough time and computer processing power
any encryption can be defeated,
including AES, DES and many others, eventually.
Well, that is all of them except one.
This is called a One-Time Pad.
Now, a One-Time Pad is a stream cipher
that encrypts plaintext information
with a secret random key that is the same length
as the plaintext input.
This secret random key is knows as a keystream
and it's comprised of a series of random bits.
If the keystream is truly random,
the only way an attacker could decrypt the information
back to the plaintext is if they had access
to that randomly created keystream.
To describe how this works a little bit,
let's do a lo-tech version of this.
Let's say that you and I both wanted to come up
with a secret code so that we can
transmit information to each other
and nobody else in the world would be able to know it.
The way we can do this is by using a One-Time Pad.
We'll each buy a thousand-page notebook and on every page,
we're going to put a number on there, at random.
And your book and my book are going to match.
So, for everyone of those thousand pages,
there's a random number on it.
So, now every time we want to send a message to each other,
we're going to perform a rotation cipher on it.
And so, if I wanted to send you the word "Hi", H-I,
then I'm going to rotate the h
by the number on the first page, which is 3.
So instead of h, it would be h, i, j, k.
So I'd put a k down.
And then I would rotate the i,
the second letter in my word,
based on the second page of our notebook,
in this case, zero.
So now I'm going to have K-I,
and send you that message.
Because you have the same notebook,
you can then subtract three from the k to get h,
and zero from the i to get i,
and you know the message is "Hi".
But anybody else in the world,
wouldn't be able to know what it was.
Now once we use those pages, we rip them out,
we burn them, and we never use them again.
Because this is truly a random key string,
and no one would be able to decrypt our messages
if they don't have that random number string
written down like we do.
The reason is, there was no real mathematical formula
or pattern to determine here.
If I use the same number for the entire message,
we can use cryptoanalysis and figure out
that all of the letters will move
by five, or 10, or 13,
but by changing every single number,
or in the data stream, every single bit,
there's no pattern.
So they're only going to be able to decode that message
if they're able to get a copy of our one-time use pads.
Now there is one problem with a one-time pad though,
and it's that there is not such thing
as a truly random sequence of numbers
if those numbers are created by a computer.
Computer aren't random.
They're based on math and algorithms.
And so, computers can't simply create
purely random numbers.
Instead, they try to simulate it, using algorithms,
and they try to create what's known
as a Pseudo-Random Number Generator, or PRNG.
This is an algorithm that spits out what looks,
to you and me, like random numbers,
but to other computers, they can figure out
what the initial seed was
and then that takes away the randomness.
These numbers are used for a variety of purposes,
including encryption, as well as game development
and other things that you might need a random number for.
For example, you may wish to have images uploaded
by your users and assign a random filename
made out of a series of numbers.
In truth, though, the numbers aren't purely random,
because computer create them based
on mathematical functions.
Or, you may need to generate a unique session key
to identify a user, and this would be
an appropriate place to use a pseudo-random number.
But, if someone can figure out the sequence
of pseudo-random numbers you're using,
they can guess the next session,
and do a session hijack.
Going back to our one-time use pad, though,
if we could create the truly random sequence of numbers
then we could securely exchange the information contained
in that one-time use pad and then we would have
a truly unbreakable encryption cipher.
Unfortunately, though, we don't have a truly
random sequence of numbers that we can rely on.
So one-time pads aren't often used.
Instead, we use the concept on one-time use passwords.
You've seen this discussed inside
our multi-fact authentication lesson.
For example, you could use a random number
that's texted to you by your website
whenever you attempt to log in.
Or, you might have an RSA secure token
that displays pseudo-random numbers
that you use to prove you have possession
of that token as your second fact of authentication.
These are two good examples of where we use
pseudo-random numbers in the security of our network.