A question on an encryption method

[IDemo]

And I'm not even sure that this would technically qualify as 'encryption', per se.

But if two or more parties wanted to secure their email contents from inspection (and I'm assuming plain text here), wouldn't the following system be virtually safe:

A large file is created with nothing more than random numbers in sequential order. Let's say the numbers can be any value from 0 to 999. Realizing that random numbers may not be as random as desired, we are still going to have a large list that will more than suffice for our needs.

Now, a program is created that will take plain text and execute a different operation on each character, referencing one or more of the numbers in our list. Let's say for example that our message begins with the letter 'A'. The executable picks the value at the 213th place of our list, 428, performs a math operation, say x = 1 * 428 * 15 (with 'A' equaling the 1 here) and writes the result into a text string. And onwards, with each successive character from the original text being used in a different operation with another number from the randomized table. The end result is what appears to be an entirely meaningless list of numbers.

The sequence of operations is compiled within the executable and can be used to decipher the message on the other end. Each of our parties is given the two files - the randomized number list and the executable.

I may be missing something here, but would this not represent a literally indecipherable method of encrypting a simple text-only email?

[Recursion]

1. If I'm understanding your description, that's called a "one time pad"

It is theoretically indecipherable, as long as you only use the random data once. If you reuse the pad, you can perform statistical analysis.

The other downside is distributing the pad to begin with to both parties -- if you have a trustworthy channel to do that, why do you need encryption in the first place?

[IDemo]

2. Upon a quick Wiki check, yes

But what's to prevent a smart enough executable from a re-shuffle of the lookups with each successive use? There could exist another table within the program that would again randomize the order of operations.

The assumption is that the pad and programs are given physically to each party to begin with, via USB drive or otherwise.

[Recursion]

3. Kerchoff's postulate

Always assume an attacker had access to the entire cryptosystem except the key.

If any byte of the pad is used more than once, an attacker can start doing statistical analysis.

[ManiacJoe]

4. Isn't this how software like PGP works?

Each message gets a new one-time pad. The pad encrypts the message. The pad is encrypted with the receiver's key and attached to the message.

[Recursion]

5. No; one time pad is symmetric key, PGP is asymmetric key

With a one-time pad, both parties (traditionally, "Alice" and "Bob&quot have to have the same key because the encipherment and decipherment processes are symmetrical. So, give them both the same pad (distributing this is the problem, because if you have a secure means of getting information from Alice to Bob already, why do they need cryptography?)

With PGP, Alice enciphers the message with Bob's public key, which only Bob's private key can decipher. Interestingly, once Alice has done this, she herself cannot decrypt the message.

[ManiacJoe]

6. Gotcha. Thanks for the correction.

[ljm2002]

7. What you describe is a one-time pad...

...and it is essentially uncrackable if used only once.

The problem for online use is this: both parties need the key. Therefore, you need a secure way to send the key before sending the enciphered message. But the key for a one-time pad is the same length as the message, so if you have a secure way to send the key, you may as well just use it to send the message in the first place.

That is why public key encryption is the gold standard for online encryption. The protocols using public and private keys allow secure key exchange even over public channels. If the key values are large enough, this is also essentially uncrackable, assuming you are using software and hardware without any back doors...