Writing

Cryptography · Aug 2026 · 13 min read

Perfect Secrecy: Why the Ultimate Cipher is Useless

Shannon formalised what it means for a secret to be perfectly kept. The one-time pad achieves it, and its cost explains why modern cryptography settled for less.

Every cipher protecting your bank, your messages, and your passwords is breakable, not just theoretically inconvenient. Given enough time and computing power, they are breakable by methods that already exist.

This raises an existential question for the field of cryptography. Is it possible to design an encryption scheme so perfect that it cannot be broken, even by an adversary with infinite time and limitless computational power?

The reality is, that this problem has already been solved. In 1949, Claude Shannon, the father of information theory, published a paper that formalised exactly what it means for a secret to be perfectly kept. This concept is known as Perfect Secrecy (or Information-Theoretic Security).

What is Perfect Secrecy?

Shannon postulated that an encryption scheme achieves perfect secrecy if reading the encrypted message (ciphertext), gives an attacker absolutely zero clues about what the original message was**.**

To understand Shannon’s idea, we must consider the adversary's perspective. Let's assume before intercepting sensitive information, an adversary already possesses some prior knowledge about what the message sent might be. For example, if a military unit is surrounded, the adversary can look at the battlefield and deduce there is a 70% chance the general will order a "RETREAT" and a 30% chance they will order an "ATTACK."

According to Shannon, the adversary's certainty after seeing the ciphertext must be identical to their certainty before they saw it. Holding the ciphertext in their hands does not make them any better at guessing the message than someone who never saw the ciphertext at all.

Formally, an encryption scheme over a message space M and ciphertext space C achieves perfect secrecy if, for every probability distribution over M, every message m ∈ M, and every ciphertext c ∈ C where Pr[C = c] > 0:

$$\Pr[M = m \mid C = c] = \Pr[M = m]$$

In this equation:

  • M represents the random variable of the message chosen.

  • C represents the random variable of the ciphertext generated.

The implication of this formula is statistical independence. If the probability of the message being m remains completely unchanged even after the ciphertext c is known, the ciphertext behaves as purely random noise, and is completely meaningless to an onlooker.

One Time Pad

A cipher perfectly matching Shannon's definition of perfect secrecy, actually predates the formal definition. Patented by Gilbert Vernam in 1919, the One-Time Pad became a staple of Cold War espionage. Rather than relying on complex prime numbers or sophisticated algorithms, it operates on three core principles:

  1. The key must be truly, mathematically random.

  2. The key must be exactly as long as the message itself.

  3. The key must never be used more than once.

I first came across the One-Time Pad around a decade ago, in Chris Ryan's Codebreaker, the third book in his Agent 21 series. In the novel, teenage MI6 agent Zak Darke faces a terrorist cell orchestrating bombings across London.

In the book, the terrorist leader plans multiple terrorist attacks and encrypts these plans using the one-time pad system. He communicates with the terrorist operatives on the ground, by placing both the message and the key in newspaper crossword puzzles, avoiding digital communication, while simultaneously hiding the plans in plain sight.

To encrypt a message using the One-Time Pad, the sender performs manual calculations using a simple alphabet-to-number grid where A=0 and Z=25. They take a plaintext message and pair it character-by-character with a random key of equal length. By adding the numerical values of the message and the key together and subtracting 26 if the result is 26 or higher, a ciphertext that appears as random noise is created.

Mathematically:

$$C=(M+K)(mod26)$$

Assuming the message is a four-letter word, because the key is perfectly random and exactly as long as the message, brute-forcing the ciphertext successfully produces every single four-letter string in existence with equal mathematical probability.

To Illustrate this, imagine an intelligence officer intercepts the ciphertext "MJQX". Using the standard alphabet-to-number grid (where A = 0, B = 1, ... Z = 25), this ciphertext translates to the numbers: 12, 9, 16, 23.

Depending on which physical key is applied to this exact same ciphertext, the mathematical formulas will yield two entirely different, perfectly coherent plaintexts.

Scenario A: Applying Key 1 ("UJLT")

The sender used a truly random, single-use key: "UJLT" (numerical values: 20, 9, 11, 19).

To decode the message, we subtract the key values from the ciphertext values. If a calculation results in a negative number, we add 26 to reset the modulo-26 boundary:

  1. First Letter: M (12)−U (20) =−8⟹−8+26 =18⟹S

  2. Second Letter: J (9)−J (9) =0⟹A

  3. Third Letter: Q (16)−L (11) =5⟹F

  4. Fourth Letter: X (23)−T (19) =4⟹E

Applying this key reveals the plaintext message: "SAFE".

Scenario B: Applying Key 2 ("VBYN")

Now imagine the adversary attempts to brute-force the ciphertext "MJQX" and tries a different, equally likely random key: "VBYN" (numerical values: 21, 1, 24, 13).

Using the exact same subtraction and modulo-26 rules:

  1. First Letter: M (12)−V (21)=−9⟹−9+26=17⟹R

  2. Second Letter: J (9)−B (1)=8⟹I

  3. Third Letter: Q (16)−Y (24)=−8⟹−8+26=18⟹S

  4. Fourth Letter: X (23)−N (13)=10⟹K

Applying this key reveals the plaintext message: "RISK".

These examples prove that intercepting the ciphertext provides the interceptor with no clue on what the actual message might be. Without holding the correct physical pad, it is mathematically impossible to prove which word was the sender's true intention, satisfying Shannon's formula.

The Price of Perfection

The One-Time Pad is mathematically flawless. It achieved the absolute pinnacle of cryptographic security. So why is it completely absent from modern digital infrastructure?

The answer lies in the principles of perfect secrecy itself. If we look at the principles of Claude Shannon's 1949 proof, the answer becomes very clear.

He proved that for perfect secrecy to exist, the key space must be at least as large as the message space. In simple terms, your key must be at least as long as your data.

To understand why this is not feasible for securing modern networks, consider the example:
Imagine trying to secure a standard internet connection using perfect secrecy. If a server needs to securely transmit a two-gigabyte file, the system must first generate two gigabytes of purely random noise as a key. Then, you must physically deliver that two-gigabyte key to the recipient with absolute security before you ever send the file.

This creates a paradoxical loop. If you already have a perfectly secure, un-compromised channel to deliver a massive key, there is no point to encrypting the message at all. You could just use that same secure channel to send the data itself.

The One-Time Pad solves the problem of secure communication, but it creates an equally impossible problem of secure key distribution, hence Its incompatibility with modern digital infrastructure.

The Two-time pad

Faced with this bottleneck, an engineer might be tempted to optimise the system. They might attempt to reuse a single key to send multiple messages and save bandwidth. This approach is known as the Two-Time Pad and it creates a vulnerability that invalidates the entire point of the One-Time Pad.

To understand why the Two-Time Pad is vulnerable, let's reuse the simple alphabet-to-number grid we discussed earlier (where A = 0, B = 1, ... Z = 25).

When a sender encrypts two different plaintext messages (M1​ and M2​) using the exact same key (K), they perform modular addition to generate two ciphertexts (C1​ and C2​):

$$C1​=(M1​+K)(mod26)$$

$$C2​=(M2​+K)(mod26)$$

An interceptor who gets both ciphertexts does not need to guess the key. They simply subtract the second ciphertext from the first:

$$C1​−C2​=(M1​+K)−(M2​+K)(mod26)$$

$$C1​−C2​=M1​−M2​(mod26)$$

Because the identical key K was added to both messages, the key subtracts itself away entirely. What the attacker is left with is a string of characters (M1​−M2​) representing the direct relationship between two unencrypted English words, with no randomness left to protect them. As we shall see in the example below, the resulting text might still look like gibberish, but it can easily be decoded.

The Tangled English Example

Let us see how this works using a short, six-letter example. Imagine the two secret messages are ATDAWN (M1​) and WEMEET (M2​). We convert them to their numerical values:

ATDAWN: 0, 19, 3, 0, 22, 13

WEMEET: 22, 4, 12, 4, 4, 19

By subtracting the numerical values of the second message from the first (adding 26 to any negative results to maintain the standard 0–25 modular boundary), the attacker "tangles" the two messages together:

  1. First Letter: A (0) − W (22) = −22 ⟹ −22 + 26 = 4 ⟹ E

  2. Second Letter: T (19) − E (4) = 15 ⟹ P

  3. Third Letter: D (3) − M (12) = −9 ⟹ −9 + 26 = 17 ⟹ R

  4. Fourth Letter: A (0) − E (4) = −4 ⟹ −4 + 26 = 22 ⟹ W

  5. Fifth Letter: W (22) − E (4) = 18 ⟹ S

  6. Sixth Letter: N (13) − T (19) = −6 ⟹ −6 + 26 = 20 ⟹ U

The resulting tangled string is EPRWSU. While this still looks like random noise, it contains absolutely no randomness or mathematical security, it can very easily be decoded.

Exposing the Secret: Crib Dragging

To read both messages, the attacker uses a technique called crib dragging. Because military and espionage communications are highly patterned, they can guess a common, expected word, a "crib", and slides it along the ciphertext to see if the math reveals a readable word in the other message.

If they guesses the four-letter word "MEET", M (12), E (4), E (4), T (19), as their crib, they drag it across the tangled string EPRWSU step by step, adding the crib's values back to the letters to test the math:

Attempt 1 (At the front): Adding MEET to the first four letters, EPRW:

  1. First Letter: E (4) + M (12) = 16 ⟹ Q

  2. Second Letter: P (15) + E (4) = 19 ⟹ T

  3. Third Letter: R (17) + E (4) = 21 ⟹ V

  4. Fourth Letter: W (22) + T (19) = 41 ⟹ 41 − 26 = 15 ⟹ P

  5. Result: QTVP (Gibberish. They slide the crib one space to the right).

Attempt 2 (The middle): Adding MEET to the middle letters, PRWS:

  1. First Letter: P (15) + M (12) = 27 ⟹ 27 − 26 = 1 ⟹ B

  2. Second Letter: R (17) + E (4) = 21 ⟹ V

  3. Third Letter: W (22) + E (4) = 26 ⟹ 26 − 26 = 0 ⟹ A

  4. Fourth Letter: S (18) + T (19) = 37 ⟹ 37 − 26 = 11 ⟹ L

  5. Result: BVAL (More gibberish. They slides the crib one final space to the right).

Attempt 3 (At the end): Adding MEET to the final four letters, RWSU:

  1. First Letter: R (17) + M (12) = 29 ⟹ 29 − 26 = 3 ⟹ D

  2. Second Letter: W (22) + E (4) = 26 ⟹ 26 − 26 = 0 ⟹ A

  3. Third Letter: S (18) + E (4) = 22 ⟹ W

  4. Fourth Letter: U (20) + T (19) = 39 ⟹ 39 − 26 = 13 ⟹ N

  5. Result: DAWN (A perfect English match!).

Because DAWN sitting at the end of the first message is a highly coherent fragment, the attacker can instantly deduce that the complete first message is ATDAWN.

Once that single word is recovered, the entire system unzips. By subtracting her confirmed guess ATDAWN back out of the original intercepted string EPRWSU, the second message, WEMEET, is revealed in full. In just three quick slides of a single four-letter word, both secret messages are completely compromised.

In summary, the entire strength of the One-Time Pad lies in the fact that the key used to encrypt a message is random and used once. Take that away, and it is fairly easy to decrypt the message. Perfect secrecy turns out to be perfect only while its conditions hold perfectly.

Compromise

To build and secure the scalable computer networks we have today, a more pragmatic approach had to be taken. One that abandons perfect secrecy in favour of computational security.

In computational security, systems are secured by practical infeasibility rather than perfect secrecy. What this means, is that the ciphers do not rely on being mathematical unbreakable**,** rather the rely on the constraint of physical time**.** Instead of defending against an adversary with infinite resources, modern algorithms are designed to make unauthorized decryption computationally exhausting.

For example, a globally trusted standard like AES-128 is theoretically vulnerable to a brute-force attack where an adversary systematically tests every possible key. However, because the keyspace consists of 2¹²⁸ possible combinations, even if you harnessed the combined processing power of every supercomputer on Earth to test those keys simultaneously, it would still take billions of years to crack a single encrypted message.

In conclusion, while the Perfect Secrecy (and by extension the One-Time Pad) stands as a testament to what is mathematically possible, modern cryptography is not about attaining perfection. It is about understanding that practicality is its own form of perfection**.** By embracing this necessary compromise, we are able to build a digital world that, while theoretically vulnerable, remains practically secure against the limits of time itself.

References

  1. Katz, Jonathan, and Lindell, Yehuda. Introduction to Modern Cryptography. © 2007 Jonathan Katz and Yehuda Lindell. All Rights Reserved.
    The industry-standard academic textbook that details the rigorous mathematical principles of contemporary private-key and public-key encryption, formalizing the definitions of computational security.

  2. Vernam, G. S. "Cipher Printing Telegraph Systems for Secret Communications." Journal of the AIEE, vol. 45, pp. 109–115, 1926.
    This foundational paper introduces the original automated telegraph cipher system that laid the practical groundwork for the One-Time Pad.

  3. Shannon, C. E. "Communication Theory of Secrecy Systems." Bell System Technical Journal, vol. 28, no. 4, pp. 656–715, Oct. 1949.
    The historic, landmark publication containing the mathematical proof of "Perfect Secrecy" and proving that the One-Time Pad is mathematically unbreakable.

  4. Ryan, Chris. Agent 21: Codebreaker. Great Britain: Doubleday Children's / RHCP Digital, 2012/2013.
    The action-adventure espionage novel following teenage MI6 agent Zak Darke as he attempts to track down a London terrorist cell utilizing analog, hidden-in-plain-sight One-Time Pad ciphers.

  5. National Security Agency (NSA). "The Venona Story." Fort Meade, MD: Center for Cryptologic History.
    An official declassified history detailing the real-world intelligence coup of the Venona Project, which successfully intercepted and decoded Soviet messages due to "Two-Time Pad" key reuse.

  6. National Institute of Standards and Technology (NIST). "Specification for the Advanced Encryption Standard (AES)." FIPS PUB 197, Nov. 2001.
    The official global standard defining the cryptographic structure of AES-128 and AES-256, demonstrating modern high-performance computational security.