One-Time Pad

The randomness has to come from a physical process, not from your head.

1. Roll dice to produce numbers 0-25, discarding out-of-range results.
2. Record a long sequence — at least as long as your intended message.
3. Now have someone write down 50 letters they think look random, and tally both.

Add the key to the message, modulo 26.

1. Number the letters A=0 to Z=25.
2. Add each plaintext number to its key number, modulo 26.
3. Convert back to letters — that is the ciphertext.
4. Subtract the same key to recover the plaintext.

Demonstrate the proof rather than quoting it.

1. Take a five-letter ciphertext.
2. Choose the target word HELLO and compute the key that would decrypt to it.
3. Now choose WORLD and compute the key for that.

The operational failure, made visible.

1. Encipher two DIFFERENT messages with the SAME key.
2. Subtract one ciphertext from the other, letter by letter, modulo 26.
3. Observe that the key has cancelled out entirely.

Gilbert Vernam at AT&T patented an automatic version in 1917, combining a punched key tape with the message tape electrically; Joseph Mauborgne added the insight that the key must be random and used only once. Claude Shannon proved the perfect-secrecy property in his 1949 paper on the mathematical theory of secrecy systems. An earlier description by Frank Miller in 1882 was rediscovered much later.

Where it applies, and where it does not. Its region is narrow and real: extremely high-value, low-volume traffic where two parties can meet in advance to exchange key material physically. The Moscow-Washington hotline used one-time tape for decades, and diplomatic and espionage traffic used printed pads on flash paper. For anything high-volume or between parties who have never met, the key distribution problem is worse than the problem it solves — which is precisely the gap that public-key cryptography later addressed by a completely different route.

The number stations heard on shortwave for decades — a voice reading endless groups of digits — are the delivery mechanism for exactly this. A pad, a radio and a shortwave receiver need no acknowledgement and reveal nothing about who is listening.

The honest summary for a catalogue of approaches: this is the only cipher with a proof, and the proof is about the mathematics only. Its three practical costs — true randomness, key volume, and one-time discipline — are what every other approach in this family is trading away in exchange for being usable.