OPERATIONAL SECURITY
The cipher is provably unbreakable. Everything else — storage, destruction, transmission — is where operations fail.
7.1 Physical Security of Materials
Technical correctness is necessary but not sufficient. Operational security (OPSEC) is the set of practices that prevent disclosure outside the cipher.
Pad Storage
- Keep pads in a physically secure location at all times.
- Never leave them in plain sight or with other papers.
- Both copies must be stored securely and separately.
Work Area
- Encrypt and decrypt in a private, controlled space.
- Close windows, draw curtains, face a wall (no one behind you).
- Clean desk: no other materials that reveal context.
Intermediates
- The plaintext digit string (after checkerboard encoding, before OTP) is plaintext-equivalent. Destroy it after use.
- Any scratch paper used during the process must be destroyed.
- Carbon paper, desk blotters, and subsequent pages on a notepad can retain impressions. Do not trust them.
Post-Use
- Used pad pages: destroy immediately. Do not accumulate used pages.
- A used pad page in your possession is a liability: it proves you sent or received a message.
7.2 Traffic Analysis
An adversary who cannot break your cipher can still learn from:
- Message frequency and timing (correlates with activity)
- Message length (suggests complexity/urgency of content)
- Transmission direction (who is talking to whom)
- Location of transmission equipment
These are metadata attacks. OTP addresses none of them.
Counter-measures:
- Send traffic at regular intervals regardless of whether you have a real message (use null/dummy messages filled with random text).
- Standardize message lengths via padding.
- These measures help with traffic analysis but reveal that you are using a discipline-based system, which itself may be informative.
7.3 Error Handling in the Field
Errors happen. Protocol:
If Receiver Cannot Decrypt a Group
- Do NOT request a resend of the message (traffic analysis risk).
- Request a check group via an agreed OOB (out-of-band) channel.
- Never indicate which group is in error (narrows attack surface).
If Sender Discovers an Error After Transmission
- Send a separate message via agreed protocol indicating that message [ID] contains an error.
- Do not re-send the same plaintext re-encrypted — this creates a depth.
- If the error is significant, use a different pad section to send a correction message stating the intent from scratch.
If Pad Pages Are Lost or Stolen
- Assume all messages encrypted with that material are compromised.
- Do not use remaining pages from the same pad (the adversary may have photographed the whole pad).
- Switch to a backup pad or establish new material via a separate channel.
7.4 Checkerboard Key Distribution
The checkerboard key (the layout of the board) must also be secret. A keyed checkerboard is part of the key material.
Typically both parties agree on the checkerboard in advance by the same channel used for the pad. Some systems use a different checkerboard for each pad book.
The checkerboard without the pad is insufficient for decryption. The pad without the checkerboard is insufficient for decryption. Both must be compromised to read a message.
This is a useful property: storing the checkerboard and pad separately and in different locations raises the difficulty of total compromise.
7.5 Compromise Protocols
If you believe the system is compromised:
- Stop all communications immediately.
- Destroy all pad material and checkerboard keys.
- Re-establish via backup or alternate channel.
- Do not transmit anything further until material and protocol are re-established.
The instinct to "send one last message warning the other party" is understandable but dangerous. That last message may be decryptable (if the key material is compromised) and will confirm to the adversary that you know.