New Encryption Method with Very Long Keys for QKD and RKD

1. Introduction

Current symmetric encryption algorithms are based on short cryptographic keys because key exchange is typically performed using asymmetric methods, which only allow for short keys. The cryptanalysis of these algorithms is fully accepted within the cryptographic community and confirms that many algorithms, such as AES [1] or ChaCha20 [2], provide sufficient security. However, these algorithms exhibit very low key entropy, and despite the extremely advanced state of cryptanalysis, their security is partly based on assumptions—albeit significantly more advanced than in asymmetric cryptography. It is the established view in the cryptographic community that, from a cryptographic perspective, a key in the megabit range is practically useless for symmetric encryption algorithms because:

• 256-bit key lengths are very secure in the long term, even against realistic attacks by quantum computers (with Grover’s reduction, the effective key length is approximately 128 bits).
• Key lengths in the megabit range do not provide any practically usable additional security compared to 256 bits and only increase storage requirements and significantly complicate key management, because effective security does not directly follow from the key length.

Physical methods for key exchange such as QKD (Quantum Key Distribution), RKD (Radiosignal Key Distribution, also known as physical-layer key generation in wireless networks), and MKD (key exchange using highly secure memories) can, however, exchange even megabits of key material in a short time (within a few days for QKD, within a month for RKD); MKD can even exchange terabytes [3]. As a result, MKD allows the use of a one-time pad (OTP) for data encryption, thereby providing provably 100% security [4]. With QKD and RKD, the large amount of key material is used for conventional symmetric algorithms with short keys, and the key is changed very frequently (e.g., every 10 minutes). From a security standpoint, however, this constant key exchange offers only a very limited improvement. If there is full confidence in the security of the symmetric algorithm—such as AES-256 or ChaCha20—rapid key exchange is not necessary, and a short key is entirely sufficient for longer periods; conversely, if there is no confidence in the algorithm, even rapid key exchange is insufficient. In other words, the extremely high costs of exchanging large amounts of key material between two nodes, as in QKD, represent a poor investment [3]. With RKD, the cost situation is significantly better, but the large amount of key material is also unnecessary. RKD is particularly interesting for highly secure communication between satellites and Earth, because MKD is not possible here, QKD is extremely expensive, and asymmetric cryptography—with its cryptanalysis based on conjecture—may be avoided.

With current symmetric data encryption methods, it is generally assumed that a 256-bit key length is sufficient and that significantly longer keys, with the exception of OTP (One-Time Pad), offer no advantages. However, there is no scientific evidence to support this claim. The security mechanisms are based primarily on confusion, diffusion, and multiple round transformations and have proven themselves for over 50 years. The longest key lengths in established algorithms range from 1,024 to 2,048 bits (e.g., Threefish-1024 [5], RC4 through RC6 [6]). The actual data encryption is usually performed using the XOR operation, as is the case, for example, with CTR mode in conjunction with established algorithms and ChaCha20. This means that a key—usually 256 bits long—is extended to an unlimited key length for XOR encryption. The entropy of the actual key when encrypting an unlimited amount of data is then at most 256 Shannon.

The method described below, called OTPH, is adapted to the conditions in QKD and RKD, where megabits of new, non-deterministic key material are exchanged daily, weekly, etc., between two communication partners and must be used; otherwise, QKD and RKD are economically pointless. OTPH fundamentally treats the new key material as a single key, regardless of its length (even for lengths in the gigabit range). In OTPH, a non-deterministic key, called KeyInput,—e.g., several megabits in length, which in practice usually originates from a QKD or RKD key exchange procedure—is used to select key bits via a special key bit selection procedure, whose selection parameters are non-deterministic random numbers, and from these, a very large number of fundamentally different intermediate keys—hereinafter referred to as Masterkeys—are generated for an HKDF (Hash Key Derivation Function) [7], which then generates the actual key for XOR encryption through key derivation. The entropy of the actual key used to encrypt the data is based on the key length of the KeyInput, in this case several mega-Shannons. The central security function here, aside from the XOR encryption, is the HKDF, for which established cryptanalytic studies exist [7].

In summary, this means that until a few years ago, there was no need for key lengths of several megabits, and only a few such keys were published in the scientific literature; however, these were examined only to a very limited extent from a cryptanalytic perspective. One of the few published methods is “Virtual Matrix Encryption (VME).” VME was developed in the late 1990s by the company Meganet and filed for a patent [8]. It was advertised as having very large key sizes (several hundred kilobits to 1 megabit), but no detailed cryptanalysis was conducted. Therefore, in contrast to the well-known symmetric algorithms, there is no consistently established cryptanalysis. However, the mere fact that no established cryptanalysis exists for these algorithms is no argument against developing and publishing new algorithms. On the contrary, with the advent of QKD and RKD, the time has come to pursue this path scientifically as well, and the present OTPH algorithm is a first attempt in this direction.

2. My Contribution

The OTPH encryption scheme described below is designed for very large keys—that is, key lengths in the megabit range—and was developed specifically for QKD and RKD. It is intended to enable QKD (Quantum Key Distribution) and RKD (Radiosignal Key Distribution) in particular to exploit the full potential of long cryptographic keys—namely, the key’s extremely high entropy.

The OTPH consists of three major processing steps. In the first processing step, the key is read in a circular manner, i.e., without end. This circular arrangement is called a cyclic buffer. From this very large cyclic buffer, which contains the entire key, the bits are read out using a special mechanism so that the key becomes significantly longer; in the second processing step, this extended key is further extended using an HKDF (Hash Key Derivation Function) and stripped of identical bit sequences; and in the third processing step, the actual data encryption takes place via an XOR operation. Through this double key extension, megabits generated by QKD or RKD can be expanded into terabits, which are sufficient for data encryption using XOR. OTPH is a one-way function that cannot be reversed.

Therefore, the OTPH encryption method employs a completely different cryptographic approach than the methods commonly used today. OTPH utilizes the extremely high entropy of Mega-Shannon to generate an even longer key with the same entropy for XOR encryption. The method has the following specific properties:

• The method adapts precisely to the entire set of key material supplied by QKD / RKD, regardless of whether it is, for example, 100 Kbit, 1 Mbit, or 16 Mbit;
• The method always uses the entire set of key material supplied by QKD / RKD as a single unit, regardless of its length. That is, the very long key is not split into shorter subkeys;
• The method uses only the XOR operation and the hash function, which are also used in QKD and RKD during postprocessing (albeit a different hash function). In other words, OTPH does not introduce any new insecure functions that are not already in use during key distribution;
• The method is extremely fast to process;
• Cryptanalysis—and thus the security assessment—is very manageable due to the simplicity of the method and focuses on the HKDF and the XOR operation, for which established cryptanalyses accepted by the cryptographic community are available [7]. This eliminates the disadvantage that no recognized cryptanalysis is yet available for this type of encryption method.
• The OTPH can encrypt only a finite amount of data with a single key. Because the OTPH was developed specifically for QKD and RKD, where new key material is constantly supplied, this limitation does not pose a problem in this context.
• OTPH must store and process long keys—which is, in principle, a requirement for QKD and RKD—and QKD and RKD must already provide the necessary key protection.

RKD and, above all, QKD generate a large number of non-deterministic random numbers per day or per week in the form of key bits for data encryption. However, the quantity can vary greatly, which must not affect the security of the encryption. For RKD, the values today range from approximately 512 Kbit to 2 Mbit per week. For QKD, the values depend heavily on the technology, the transmission method (fiber optic cable, free-space channel, satellite), and the operating and environmental conditions [3]. The values therefore currently vary between approximately 500Kbit and 1 Gbit per day. Because these values can also vary significantly during operation, the encryption method must be able to respond flexibly to them.

3. OTPH Encryption Scheme (One-Time Pad with HKDF)

The non-deterministic key, which is input from outside as the base key, is called “KeyInput”; the key for data encryption using the XOR operation is called KeyXOR. Furthermore, there are Masterkeys that function as intermediate keys and represent the result of the first processing step.

The OTPH encryption scheme (One-Time Pad with Hash Key Derivation Function for key generation) is based on three processing steps:

• Calculation of Masterkeys for an HKDF using a bit-selection procedure with non-deterministic parameters. In this process, bits are read in a circular manner from the KeyInput key of length “p.”
• Determination of the key for XOR encryption through repeated key derivation using an HKDF (Hash Key Derivation Function)
• Data encryption using the XOR operation

In the OTPH method, KeyInput is treated as a cyclic buffer with modulo addressing [9], and the length of KeyInput must be a prime number “p.” This means that the key KeyInput, with length “p,” is read in a circular manner and therefore has no end. During each read operation, “a” bits are sequentially read from the cyclic buffer at a bit spacing of d_x. That is, the bits are not read immediately one after another, but at a specified bit spacing of d_x. After g_x read operations with the specified d_x, the value of x is incremented by one. That is, in the first processing step, the bits are read from the cyclic buffer with a bit spacing of “d_x,” and only “g_x” read operations of length “a” bits are performed with this d_x. Together, these two values form “a” d_x-pairs “(d_x║g_x).” There can be at most (p-1) d_x-pairs “(d_x║g_x)”, and the values of “d_x” can vary between 1 and (p-1), while the values of “g_x” can vary between 1 and “p”. In practice, however, these upper limits are rarely reached; for the g_x values, they are usually even well below these limits, which significantly reduces the reuse of the same bits from the KeyInput. All d_x-pairs “(d_x║g_x)” are non-deterministic random numbers, and thus the read operation from the cyclic buffer is purely random.

The “a” bits, which are read from the cyclic buffer per read operation in the first processing step with a bit spacing of d_x and constitute a read block, are immediately processed as a Masterkey in the second processing step of the HKDF, and this then yields the key KeyXOR_ec for the third processing step. The read logic in the first processing step guarantees that all resulting read blocks of length “a”—i.e., all Masterkeys of the HKDF—are different, and that this holds for a maximum of (p²-p) read blocks (corresponding to maximum values of d_x times g_x). However, this theoretical value cannot be achieved because g_x would always have to be equal to “p,” whereas g_x is a non-deterministic random number.

3.1. Procedure

• First, the length “a” for each read operation from the cyclic buffer and the size of the cyclic buffer “p”—i.e., the key length—are determined. “ec,” the encryption counter, starts at ec = 1 and is incremented by one after each read operation of “a” bits from the cyclic buffer. In addition, it must be determined how many bits are used for block encryption after a read operation from the cyclic buffer. That is, how many “T_i” values are determined in the HKDF that lead to the key KeyXOR_ec. These parameters are called “a” (input length for the HKDF’s Masterkey_ec), “p” (length of the cyclic buffer), and “ol” (output length of the HKDF), where “p” must be a prime number. In other words, “a” represents the length of the input to the HKDF process, and “ol” represents the length of the HKDF’s output. This output, called KeyXOR_ec, is used to encrypt the bits of the data blocks m_j using the XOR operation. All results from the key derivations using the HKDF constitute KeyXOR, which consists of all individual KeyXOR_ec values. Another important parameter are the d_x-pairs (d_x║g_x).
• The data “m” to be encrypted is divided into data blocks of length “z” bits. The block number is “j”. z = 512 is recommended.
• Encryption is performed one data block at a time. For each data block of length “z” bits, “z” bits are sequentially extracted from the result of the HKDF, which yields the key KeyXOR_ec. When all bits of KeyXOR_ec have been used up—which occurs after ${\displaystyle \frac{ol}{z}}$ data blocks—the counter “ec” (encryption counter) must be incremented by one, and “a” bits must be read from the cyclic buffer and processed. When a new “KeyInput” of length “p” is loaded into the cyclic buffer, “ec” is reset to one (ec = 1). The parameters “a”, “ol”, “p” and all d_x mit 1 ≤ x < p and all g_x mit 1 ≤ x ≤ p must remain constant at least until a new KeyInput is loaded into the cyclic buffer.

3.2. Processing Step 1

In a single read operation—i.e., using the same “ec,” “a,” “d_x,” and “p”—“a” bits are read from the cyclic buffer, and for the individual bit addresses in the cyclic buffer

bp₁, bp₂, bp₃, ……., bp_a-1, bp_a

the following formulas are used:

bp₁ = (ec – 1) * d_x * a (mod p)

bp_i+1 = bp_i + d_x (mod p) $\forall$i with 1 ≤ i < a

The bits at positions bp₁, bp₂, bp₃, ……., bp_a-1, bp_a form a Masterkey_ec for the subsequent HKDF. Afterward, “ec” is incremented by one, and the process is repeated. After g_x such read operations—and thus g_x Masterkeys for the HKDF—the value “x” is also incremented by one, and “a” values are read again using these formulas. At the latest when “x” reaches the value “p,” the process is terminated because the results then begin to repeat. Up to this point, the procedure guarantees that all read results of “a” bits—and thus all Masterkey_ec—are different.

When decrypting the data, the same “bp” must be used as in the encryption process; that is, in the data storage application, the values of KeyInput, “a,” “p,” “ol,” “ec,” and “(d_x║g_x)” used during data encryption must be stored. In telecommunications applications, both parties (or more, in the case of multiple telecommunications partners) must use the same “bp,” i.e., they must use the same values for KeyInput, “a,” “p,” “ol,” “ec,” and “(d_x║g_x).” All possible values of “(d_x║g_x)”, i.e., (d₁║g₁), (d₂║g₂), …, (d_p-1║g_p-1), are part of KeyInput, regardless of whether they are at the beginning of the cyclic buffer or separate from it (see Section 3.5. below). The KeyInput key is changed when the key generation is changed during data storage in the application, for example, when an authorized user leaves a role, or when a different role is involved (each role has its own key with its own generations), or when new key material is available from QKD / RKD for a key in the telecommunications application.

Figure 1. OTPH encryption method.

Figure 1. OTPH encryption method.

3.3. Processing Step 2: HKDF

In Processing Step 2, an HMAC based on the RFC 5869 Key Derivation Function is used [7]. SHA-3-512 (ISO/IEC 9707 and 10188), for example, can be used as hash function. The choice of HMAC is flexible in OTPH.

The following function is used for this:

T₁ = HMAC_Masterkey(Hash(KeyInput), “First Part”, 0x01),

T₂ = HMAC_Masterkey(T₁, “Second Part”, 0x02),

T₃ = HMAC_Masterkey(T₂, “Third Part”, 0x03), and so on.

This results in the Key KeyXOR_ec, which provides the actual key bits for the XOR operation used in data encryption:

KeyXOR_ec = T₁ ‖ T₂ ‖ T₃ ‖ T₄ ‖ T₅ ‖ T₆ ‖ ………

Hash(KeyInput) can, for example, refer only to the first 10 Kbit of the KeyInput—while maintaining the same level of security—in order to save processing time.

For the last data block—which may, of course, be shorter—a correspondingly smaller number of bits from KeyXOR_ec are used, and thus no padding is required.

A new KeyXOR_ec is calculated after each read operation of “a” bits from the cyclic buffer using the Masterkey_ec. Afterward, “ec” is incremented by one, and processing step 1 begins again.

Combining HKDF and “d_x-variation” makes it possible to significantly increase the key length—that is, the number of key bits—for example, from 1 MByte of KeyInput to TBytes of KeyXOR.

3.4. General Information

The block length for data encryption and decryption using XOR operations should be 512 bits. No padding is required for the last block, which means it can be shorter. If only one block is present and it is shorter, this does not pose a security risk. OTPH allows for partial encryption, i.e., the encryption and decryption of individual data blocks is possible, and identical unencrypted data blocks m_i = m_j result in different encrypted data blocks c_i ≠ c_j. These three properties are important advantages of the OTPH encryption method.

Since the key KeyInput is extended from “a” bytes (input length) to “ol” bytes (output length) per read operation, and theoretically a maximum of (p² – p) read operations of “a” bits (if g_x = p holds for all values, which must not be the case in practice) until a repetition occurs, the maximum length of the key used for encryption is:

$$lengthKeyXOR={\displaystyle \sum _{x=1}^{p-1}}{g}_x\times ol$$

If all g_x are different, Gauss’s theorem yields:

$$lengthKeyXOR={\displaystyle \frac{({\left(p-1\right)}^2+p-1)\times ol}{2}}$$

In practice, all “g_x” must be non-deterministic random numbers. For example, with a key length KeyInput, i.e., “p,” of 20 Mbit—which the physical QKD process can achieve over a line connection within a single day—and an extension by the HKDF by approximately a factor of twenty key derivations, this results in a maximum of approximately 500 TByte of keys per day for data encryption using the XOR operation—an extremely high daily value.

However, this maximum should not be targeted, because at this maximum, every bit of the KeyInput key (i.e., the individual bits in the cyclic buffer) is used very frequently, even though the order of the bits used differs for each read operation. However, if g_x—which specifies how often d_x must be read—is limited, e.g., to 16 bits (2 bytes), the key length in the above example decreases, and the 20 Mbit still results in approximately 5 Tbyte length of KeyXOR.

The trade-off between the size of g_x and the number of key derivations in the HKDF should always aim for a smaller g_x, so that the bits from the KeyInput are not used too often. In practice, the size of g_x is determined by the KeyInput, and the number of key derivations can be adjusted to the length of the data to be encrypted.

In the OTPH method, despite the repeated use of individual bits from KeyInput in the cyclic buffer, the following applies:

(1) the bits read from the cyclic buffer represent a non-deterministic random number,

(2) the order of the bits read changes after g_x read operations, with the read interval between bits determined by d_x, which also represents a non-deterministic random number,

(3) The bits read from the cyclic buffer during each read operation, as described in (1) and (2), undergo a security-critical processing step via the HKDF: they serve as the input to the HKDF and it is only from this that the actual key, KeyXOR, for data encryption using the XOR operation is derived.

3.5. Versions for the Application of d_x-Pairs

An important security measure is reading the bits from the cyclic buffer with a bit spacing of “d_x” and ensuring that only “g_x” blocks are read with this “d_x,” i.e., each “d_x” is applied only “g_x” times. Together, these two values form a d_x-pair (d_x║g_x). All d_x-pairs are non-deterministic random numbers, and thus the read operation from the cyclic buffer is purely random.

When determining and storing all d_x pairs, there are three versions for OTPH:

1. The key KeyInput, with a length of “p,” also contains all d_x-pairs; that is, every bit of the key is simultaneously part of a d_x-pair. This allows for ${\displaystyle \frac{p^2-p}{64}}$ distinct d_x pairs. Each d_x pair requires 48 bits (3 bytes per “d_x” and “g_x”), and dividing by 64 provides a sufficient reserve for identical “d_x” values that must be ignored (all “d_x” values must be different).

2. The d_x pairs are stored separately. This would theoretically allow for all (p² - p) different d_x pairs. In practice, however, this version requires a very large number of additional non-deterministic random numbers, which are not available.

3. The parameters (y₁, b, r, g₁) are stored separately. Each of these parameters requires only three bytes, meaning the number of additional bits is only 12 bytes, which are determined using QKD or RKD. Because all d_x pairs must be distinct, but in this version they are not stored and therefore cannot be verified, they are determined using a linear congruence generator of the form

y_i+1 = (b * y_i + r ) (mod p – 1)

For all y_i to be different, the following must hold:

r must be coprime to (p – 1), every prime factor of (p – 1) must divide (b - 1), and if (p – 1) is divisible by 4, then so must (b - 1). Since the four parameters represent non-deterministic random numbers, but “b” and “r” must satisfy the above conditions, the parameters “b” and “r” must be increased until the conditions are met.

For the individual d_x pairs, the following then holds: d_x = y_x + 1

The second value of the d_x pairs, “g_x,” is always determined from the previous read operation involving a d_x value—i.e., d_x-1—by using the first three bytes of the “a” bytes to be read. The first “g_x” value, “g₁,” is part of the four parameters (see above).

4. In this version, Version 1 is applied for up to ${\displaystyle \frac{p^2-p}{64}}$ read operations, after which Version 3 is used. Since identical d_x values must be ignored, Version 3 must now also check whether the new d_x value has not already been used in Version 1. Version 4 has the advantages that all (p² – p) read operations are possible and that all d_x values up to ${\displaystyle \frac{p^2-p}{64}}$ read operations are non-deterministic random numbers. Therefore, Version 4 is recommended. Up to $ec={\displaystyle \frac{p}{a}}$, it provides only non-deterministic key bits as input for the HKDF; up to $ec={\displaystyle \frac{p^2-p}{64}}$, all d_x are still non-deterministic; and thereafter—which will rarely occur in practice (because “p” is usually large enough)—all d_x are deterministic due to the congruence generator. In other words, Version 3 serves only as a supplement for particularly large key requirements.

4. OTPH Cryptoanalysis

4.1. Formalization

Given:

• a secret key KeyInput of length p $>{10}^6$ bits
• p is a prime number
• KeyInput is treated as a cyclic buffer
• For each read operation in the first processing step, a bits are read from KeyInput, and the result is a Masterkey for the HKDF of length a bits
• The selection of the a bits is determined by a read interval d_x:
• $K\left[i\right],K[i+d],K[i+2\times d],\dots ,K[i+a\times d]$ (modulo$p$)
• After g_x read operations, the read interval d_x is changed by incrementing x by one
• g_x and d_x exist for alle $1\le \mathrm{x}\le \mathrm{y}$ and are non-deterministic random numbers, i.e., there are y different g_x and d_x, and the maximum value of y is (p-1)
• ec (encryption counter) starts at ec = 1 and is incremented by one after each read operation of a bits. The maximum value of ec is ${\displaystyle {\sum }_{x=1}^y}{g}_x$
• A key is derived from the Masterkey of length a bits:
• T₁ = HMAC_Masterkey(Hash (KeyInput), “First Part”, 0x01), T₂ = HMAC_Masterkey(T₁, “Second Part”, 0x02), T₃ = HMAC_Masterkey(T₂, “Third Part”, 0x03), and so on

  KeyXOR_ec = T₁ ‖ T₂ ‖ T₃ ‖ T₄ ‖ T₅ ‖ T₆ ‖ ………
• The length of each KeyXOR_ec is ol (output length)
• All KeyXOR_ec combine to form the KeyXOR, which serves as the XOR keystream for encryption
  The total length of the KeyXOR is calculated as

  $$lengthKeyXOR={\displaystyle \sum _{x=1}^y}{g}_x\times ol$$

Security depends primarily on whether the generated bit sequence KeyXOR is indistinguishable from a truly random sequence to an attacker and whether the same keystream KeyXOR_ec is never used twice.

4.2. Properties

• Very high key entropy:

The non-deterministic key KeyInput > 1 Mbit possesses enormous entropy, e.g., 1 mega-Shannon. Even if an attacker knows the complete algorithm, they would theoretically have to reconstruct a state with more than one million unknown bits. This is significantly greater than the key lengths of modern algorithms (AES-256, ChaCha20-256 etc.), which have a maximum entropy of 256 Shannon.

The secret lies in the OTPH’s use of the triple:

(KeyInput, all d_x, all g_x).

These three secrets are always used together in the first processing step as (KeyInput, d_x, g_x).

2.

Prime-number-length of KeyInput:

The prime-number-length of the key KeyInput prevents certain periodic structures. If the number p is prime and $\mathrm{g}\mathrm{c}\mathrm{d}(d_x,p)=1$then the sequence $i,|i+d_x,|i+2d_x,\dots$pass through all positions of the ring before it repeats. This prevents short cycles from forming.

3.

HKDF with Hash Function:

Because a cryptographically strong hash (e.g. SHA-3-512) is used, the outputs appear random. A cryptanalysis of the HKDF has been established within the cryptography community [7].

4.

Key Reuse:

As with CTR mode, ChaCha20, etc., care must be taken with OTPH to ensure that the same KeyXOR, or parts of KeyXOR, is not used twice for encryption. This risk cannot occur with proper use because the KeyXOR is very long and QKD and RKD constantly supply new key material.

5.

Critical Issue “Overlap Between Masterkeys”:

Although the bits are read at an interval of d_x and, after a change of d_x, reading always continues from the end with the next d_x, bit overlaps from KeyInput can occur after ${\displaystyle \frac{p}{a}}$multiple read operations. The result is that while all outputs from the first processing step—and thus all HKDF Masterkeys—are different, subsets of these Masterkeys may be identical when considered together. These correlations can be detected as static structures using complex methods. A cryptographic hash possesses an avalanche effect. In the second processing step—the HKDF—these structures are eliminated. Therefore, the cryptanalysis of the HKDF is particularly important (see below).

The number of these possible overlaps can be reduced by decreasing the value y (the maximum value of x), which corresponds to a reduction in the number of available (d_x║g_x) pairs; or by increasing the number of T_i (key derivations in the HKDF), which is also easily achievable; or by replacing the key KeyInput with a new one, thereby setting the values ec and x to one. In QKD (Quantum Key Distribution) and RKD (Radiosignal Key Distribution)—the main areas of application for the OTPH—the KeyInput should therefore be changed as soon as sufficient new key material becomes available. In QKD and RKD, this can be done, for example, daily or weekly.

Since the first processing step yields only a finite number of Masterkeys of length a, the sequence becomes periodic after ${\displaystyle {\sum }_{x=1}^{p-1}}{g}_x$ read operations (depending on the KeyInput length p and the individual g_x values), which corresponds to an extremely long period. The OTPH can therefore encrypt only a finite amount of data with a single KeyInput. Because the OTPH was developed specifically for QKD and RKD, where new key material is constantly supplied, this limitation does not pose a problem in this context. The central security issue therefore lies with the HKDF, which, on the one hand, must eliminate statistical structures across all Masterkeys and, on the other hand, must not enable any new attacks—even during key derivation.

4.3. Security Analysis of HKDF

However, there is a cryptanalytic analysis of the HKDF that is accepted and well-established within the cryptography community [7].

This publication contains the formal security analysis of HKDF, on which RFC 5869 is also based. Before HKDF, many key derivation functions were constructed rather ad hoc. Krawczyk shows in [7] that key derivation must be neatly divided into two steps:

Extract: Extracts a pseudorandom key (PRK) from key material that may be noisy or not perfectly random. It transforms unevenly distributed or flawed key material into a cryptographically strong intermediate key.

Expand: Uses this PRK to derive any number of mutually independent keys.

This allows a nearly random key to be derived from sources with very high entropy but potentially poor distribution; additionally, the HKDF serves as a so-called “computational extractor.” And this is precisely what applies to the Masterkeys in OTPH, which are generated in the first processing step.

Another important aspect of the HKDF is the salt. In OTPH, the first key, T₁, is generated using the hash value of the KeyInput, which is unpredictable. For the subsequent T_i keys, the previous one—i.e., T_i-1—is always used. The salt is random and has the ideal length of the HMAC [7].

The HKDF does not generate new randomness—which is not even necessary in the OTPH due to its very high entropy—but rather distributes it optimally. Analysis of the HKDF shows that different values of the Masterkey generate practically independent keys.

A key result of the analysis is: “If HMAC is secure as a pseudorandom function, then the HKDF is also secure.” Therefore, all vulnerabilities in the input material—in the case of OTPH, the Masterkeys—are addressed in the extract phase, and only then are the actual session keys—in the case of OTPH, the T_i—generated. This means that KeyXOR is practically indistinguishable from a random key. This is particularly valuable for cryptanalysis because the security does not rely on new, untested assumptions, but rather on a construction that has already been extensively studied.

4.4. XOR Encryption

The XOR operation used in the third processing step is considered a restricted one-time pad (OTP) [4] that is provably 100% secure. The requirements for a one-time pad to be provably 100% secure are:

• The key must be completely random, i.e., generated by a non-deterministic random number generator
• The key must be at least as long as the unencrypted data
• New key bits must be used for each new encryption; that is, the key—or any part of it—must never be reused

Of these three OTP conditions, the first—that the key must be completely random—can no longer be fully met with OTPH. The other two conditions:

• The key must be at least as long as the unencrypted data
• New key bits must be used for each new encryption
• can be met.

5. Conclusions

In practice, QKD and RKD are becoming increasingly important for the highly secure generation and distribution of cryptographic keys—and, consequently, for encryption methods that are optimally adapted to QKD and RKD. This article presents a new symmetric encryption scheme that was developed specifically for QKD and RKD and their requirements. OTPH adapts precisely to the existing key material of QKD and RKD and can incorporate the extremely high available entropy into the encryption process.

The OTPH is a one-way function that cannot be reversed. Only the KeyXOR used for XOR encryption can be determined from the initial key KeyInput. In principle, however, it goes without saying that the entropy of the key does not automatically determine the security level; that is, the OTPH is not 4,000 times more secure than AES simply because it uses a 1 Mbit key.

A new cryptographic method such as OTPH—especially given its novel design—must first establish itself within the cryptographic community. This has been and remains true for all new methods, such as elliptic curves in asymmetric cryptography, which were met with skepticism for over a decade, or, today, Crystals Cyber’s post-quantum cryptography. However, thanks to the cryptanalysis of the HKDF and the one-time pad, the OTPH is well-positioned to succeed.

In practice, the OTPH will not compete with conventional symmetric encryption algorithms such as AES or ChaCha20, but will instead be used primarily in the context of QKD and RKD, and possibly also MKD (key exchange via highly secure storage media).