The key distribution problem

If the one-time pad is unbreakable, why don't your browser, your email, and your bank use it? Because of an insurmountable practical obstacle: key distribution.

The chicken-and-egg problem

To exchange messages in secret, Alice and Bob must first share a pad. But this pad must be as long as the sum of all the messages they will ever exchange. For a year of emails, that could represent gigabytes of key.

But how do you transmit this enormous key secretly? You would already need a secure channel… but if such a channel existed, you might as well send the messages through it!

   To send 1 GB of messages in secret
   ----------------------------------------
   you must first share 1 GB of key... in secret.
                    │
                    ▼
   But sharing 1 GB in secret is already
   the problem we wanted to solve.
                    │
                    ▼
              vicious circle

In practice, this requires physically transporting the key (diplomatic pouch, in-person meeting) before any communication, in colossal quantities. Impossible on the scale of the Internet and its billions of spontaneous exchanges.

The practical solution: stream ciphers

The industry found a compromise. Rather than a truly random pad, we start from a small shared key (128 or 256 bits) and stretch it with a pseudorandom generator (cryptographic PRNG) into a long stream of bits, the keystream. We then encrypt with XOR, exactly like a one-time pad:

   Ideal OTP               Stream cipher
   ---------               -------------------
   truly random            small key (256 bits)
   key                              │
   as long as the            [ cryptographic PRNG ]
   message                          │
        │                    pseudorandom keystream
        │                    (as long as needed)
        ▼                            ▼
   C = M XOR K              C = M XOR keystream

   PROVEN security          ASSUMED security
   (unconditional)          (computational)

This is the principle of ciphers such as ChaCha20 or the older RC4: they imitate the one-time pad from a small seed that is easy to share.

The price to pay

This compromise trades unconditional security for convenience. The keystream is no longer truly random: it is deterministic, entirely decided by the small key. Shannon's proof therefore no longer applies.

• The key is no longer as long as the message: it is a few bytes.
• Security becomes computational: it holds as long as no one can predict the PRNG.
• A poorly designed stream cipher (RC4) has been broken — the one-time pad, never.

We accept this risk because it makes cryptography usable: a 256-bit key is enough to protect gigabytes of traffic.

In summary

• The one-time pad requires sharing in advance a key as long as all future messages: the chicken and egg.
• Distributing this key secretly already assumes the secure channel we are looking for: a dead end on the scale of the Internet.
• In practice, we use stream ciphers: a small key + a PRNG produce a keystream that imitates the pad.
• The price: we go from unconditional security to computational (assumed) security, in exchange for real-world usability.