{"id":1208,"date":"2026-11-01T08:36:45","date_gmt":"2026-11-01T07:36:45","guid":{"rendered":"https:\/\/hadamard.com\/c\/one-time-pad-unbreakable-shannon-proof\/"},"modified":"2026-11-01T08:36:45","modified_gmt":"2026-11-01T07:36:45","slug":"one-time-pad-unbreakable-shannon-proof","status":"publish","type":"post","link":"https:\/\/hadamard.com\/c\/one-time-pad-unbreakable-shannon-proof\/","title":{"rendered":"Is the One-Time Pad Unbreakable? Shannon’s Proof and Venona"},"content":{"rendered":"

Is the one-time pad unbreakable? Yes, in a strict mathematical sense. Claude Shannon proved that if the key is truly random, at least as long as the message, kept secret and never reused, the ciphertext tells an attacker nothing about the plaintext, however much computing power they have. In practice those conditions are hard to meet, and when they slip, the pad stops being secure. The best-known example is the Venona project, where duplicated pad pages let US codebreakers read part of the Soviet Union’s wartime traffic.<\/p>\n

This article covers how the pad works, who invented it, what Shannon actually proved, and why everyday encryption uses something else.<\/p>\n

Is the one-time pad unbreakable? The short answer<\/h2>\n

The one-time pad is the only widely known cipher with a proof of perfect secrecy<\/em>. That proof holds only when all four of these conditions are met:<\/p>\n

    \n
  1. The key is truly random.<\/strong> Every possible key must be equally likely. A key from a predictable generator or a human “random” choice doesn’t qualify.<\/li>\n
  2. The key is at least as long as the message.<\/strong> Every bit or character of plaintext needs its own key bit or character.<\/li>\n
  3. The key is used only once.<\/strong> As soon as any part of a key encrypts a second message, perfect secrecy is gone.<\/li>\n
  4. The key stays secret.<\/strong> Both parties need a copy, and nobody else can get one, either in transit or in storage.<\/li>\n<\/ol>\n

    If any condition fails, the pad becomes an ordinary cipher, and often a weak one. The math is fine. Real systems break because of how the keys are made, delivered and handled.<\/p>\n

    How the one-time pad works: XOR with a truly random key<\/h2>\n

    In its modern binary form, also called the Vernam cipher, encryption is a bitwise XOR (exclusive or) of the message with the key. XOR gives 1 when the two input bits differ and 0 when they match. XOR undoes itself, so the receiver XORs the ciphertext with the same key and gets the message back.<\/p>\n\n\n\n\n\n\n\n\n
    Step<\/th>\nBits<\/th>\n<\/tr>\n<\/thead>\n
    Message<\/td>\n1011 0010<\/td>\n<\/tr>\n
    Key (random)<\/td>\n0110 1100<\/td>\n<\/tr>\n
    Ciphertext = message XOR key<\/td>\n1101 1110<\/td>\n<\/tr>\n
    Ciphertext XOR key<\/td>\n1011 0010 (message recovered)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Here is why this hides everything. For any ciphertext and any<\/em> candidate plaintext of the same length, exactly one key turns one into the other. If all keys are equally likely, all plaintexts stay equally plausible. An attacker who tries every key doesn’t find “the” answer. They find every possible message of that length, including all the wrong ones, and have no way to choose between them.<\/p>\n

    Who invented the one-time pad? Miller, Vernam and Mauborgne<\/h2>\n

    Frank Miller, 1882<\/h3>\n

    The earliest known description comes from Frank Miller, a Sacramento banker. In 1882 he published Telegraphic Code to Insure Privacy and Secrecy in the Transmission of Telegrams<\/em>, roughly 35 years before the version usually credited as the first. Computer scientist Steven Bellovin found the book at the Library of Congress and described it in Cryptologia 35(3), July 2011<\/a>. He found no evidence<\/a> that Vernam or Mauborgne ever met Miller, so the later invention appears to have been independent.<\/p>\n

    Gilbert Vernam’s 1919 patent<\/h3>\n

    Gilbert S. Vernam, an AT&T engineer from Brooklyn, filed US Patent 1,310,719, “Secret Signaling System”<\/a> on September 13, 1918. It was issued on July 22, 1919. The patent combines the Baudot-code teleprinter impulses of the message and the key using relay logic. That operation is XOR, although the patent never uses the word. The NSA has called it “perhaps one of the most important in the history of cryptography.”<\/a><\/p>\n

    Vernam’s original design wasn’t a true one-time pad yet. It read the key from a loop of tape that repeated<\/a>, so on long messages the key was reused.<\/p>\n

    The contested question of the non-repeating key<\/h3>\n

    Who first insisted that the key must be random and must never repeat is still disputed. Historian David Kahn credited Vernam with randomness and Army Signal Corps officer Joseph Mauborgne with non-repetition, and Mauborgne claimed that credit himself. Bellovin’s 2014 research<\/a> argues that Vernam most likely came up with non-repetition and that Mauborgne contributed to the two-tape version. The surviving evidence doesn’t settle it.<\/p>\n

    Shannon perfect secrecy: what the 1945 proof actually says<\/h2>\n

    Claude Shannon gave the pad its theoretical foundation. He first wrote up the work in a classified Bell Labs memo, A Mathematical Theory of Cryptography<\/em> (MM 45-110-02), in 1945, which was later declassified. A version was published in 1949 as “Communication Theory of Secrecy Systems”<\/a> in the Bell System Technical Journal, vol. 28, pp. 656\u2013715. Shannon showed that the one-time pad is perfectly secret and that any theoretically unbreakable cipher must meet the same requirements as the pad.<\/p>\n

    What “perfect secrecy” means<\/h3>\n

    A scheme is perfectly secret if seeing the ciphertext doesn’t change what an attacker knows about the message. Formally, the probability that the message is m<\/em> given ciphertext c<\/em> equals the probability of m<\/em> before the ciphertext was seen. An equivalent definition, used in course notes such as UChicago’s CMSC 28400<\/a> and Oxford’s cryptography lectures<\/a>, says that with a uniformly random key, every message produces the same distribution of ciphertexts. A ciphertext that looks the same no matter which message produced it carries no information about that message.<\/p>\n

    This definition doesn’t depend on a hard math problem or on limits to the attacker’s computing power. It’s a statement about probability, so it holds against unlimited computation.<\/p>\n

    The catch: the key must be as long as the message<\/h3>\n

    Shannon also proved the cost. Any perfectly secret scheme needs at least as many possible keys as possible messages, written |K| \u2265 |M|. In practice, the key must be at least as long as the message. The proof, presented in Northeastern’s lecture notes<\/a>, Cornell CS6830<\/a> and Yevgeniy Dodis’s notes at NYU<\/a>, works by contradiction:<\/p>\n