The one-time pad is the only cipher with a mathematical proof of perfect secrecy. Shannon demonstrated in 1949 that if the key is truly random, at least as long as the plaintext, used exactly once, and kept secret, the ciphertext reveals nothing about the plaintext regardless of the adversary's computational power. No assumptions about hard problems. No reliance on key length outpacing Moore's Law. Information-theoretic security, not computational security.
This proof survives quantum computing. It survives every advance in cryptanalysis that has occurred or will ever occur, because it does not depend on the difficulty of any mathematical operation. It depends on the statistical independence of the key from the plaintext. That independence is a physical property of the key material, not a computational property of an algorithm.
Which means the security of a one-time pad system lives entirely in the key material. How it is generated, what it is printed on, how it is transported, how it is stored, and how it is destroyed after use. Every one of those operations is a physical process, subject to physical constraints and physical attack. The cryptography is trivially simple -- modular addition. The engineering is where the system succeeds or fails.
This article covers the substrate problem: what physical material should OTP key pages be printed on, given the competing requirements of readability, portability, concealment, and rapid destruction under adversarial conditions.
Why Physical Key Material Still Matters
The obvious question is why anyone would use physical key material in an era of digital communication. The answer is threat model specificity. There are operational environments where digital key storage is the vulnerability, not the solution.
An air-gapped facility that must communicate securely with another air-gapped facility has no digital key transport channel that does not at some point involve a physical medium (USB drive, optical disc) that crosses the gap. The medium must be protected, transported, and destroyed. If you are already solving the physical security problem, the key material might as well be the message system itself.
Embassy communications under hostile surveillance assume that every electronic device in the building is compromised or could be. Side-channel attacks, firmware implants, supply-chain interdiction of hardware -- the attack surface of a digital system in a hostile environment is enormous. A pad of paper in a safe has an attack surface of "someone opens the safe."
Backup authentication systems for critical infrastructure need a method that works when the power is out, the network is down, and the HSM is inaccessible. A laminated card with a grid of one-time codes in a sealed envelope in a physical vault is the backup of last resort for nuclear command authority, and has been for seventy years, because it has no dependencies.
These are niche use cases. They are real use cases. And they have specific material requirements that the broader cryptographic community rarely discusses because the broader community is, reasonably, focused on digital systems.
Substrate Requirements
A substrate for OTP key material must satisfy five requirements simultaneously. Failure on any one of them can compromise the system.
Writability. The substrate must accept and retain markings -- printed or handwritten -- with sufficient clarity and permanence to be read accurately under operational conditions. Those conditions may include low light, stress, gloved hands, and time pressure. A digit misread as another digit is a decryption failure.
Readability. The printed or written characters must be unambiguous. This is partly a typography problem (font selection, character spacing) and partly a substrate problem (surface texture, contrast, resistance to smudging). A glossy surface may produce better print contrast but is unusable with a pencil. A rough surface takes pencil well but may cause inkjet output to feather.
Portability. The substrate must be concealable on a person or in personal effects. Thin, lightweight, foldable without cracking, and unremarkable in appearance. A pad that looks like a pad of random numbers is a pad that identifies its carrier as someone using a pad of random numbers.
Durability. The substrate must survive the conditions of transport and storage without degradation. Humidity, temperature variation, mechanical stress from folding and handling, accidental exposure to water or sweat. Key material that becomes unreadable in a coat pocket during a rainstorm is key material that has failed.
Destructibility. This is the requirement that dominates substrate selection and separates it from every other printing problem. The substrate must be destroyable rapidly, completely, and verifiably under field conditions. "Rapidly" means seconds, not minutes. "Completely" means no recoverable fragments. "Verifiably" means the operator can confirm destruction is complete. This requirement is in direct tension with durability, which is what makes the engineering interesting.
Historical Substrates
The history of OTP substrate selection is largely a classified history, but enough has been declassified or independently documented to establish the major approaches and their tradeoffs.
Silk
SOE (Special Operations Executive) and OSS used silk extensively during World War II for one-time pad key material and cipher tables. Silk is thin, strong, silent when handled (unlike paper, which rustles), and can be sewn into clothing or concealed in the lining of personal effects. It takes ink well from specialized printing processes and resists tearing.
The drawbacks are significant. Silk is difficult to destroy quickly. It does not burn cleanly -- it melts, chars, and produces a distinctive smell. It cannot be dissolved in water. Cutting it into small pieces with scissors is slow and leaves recoverable fragments. Modern forensic techniques can reconstruct text from charred silk fragments using multispectral imaging.
Silk was a reasonable choice in 1943 because the primary concealment threat was a physical search, and silk excels at concealment. The destruction threat model was less severe -- if an agent was captured, the concern was bulk cipher material, not individual key pages. For modern use cases where rapid, verifiable destruction is a hard requirement, silk is inadequate.
Nitrocellulose (Flash Paper)
Nitrocellulose paper -- cellulose treated with nitric acid to produce a highly flammable substrate -- solves the destruction problem definitively. It ignites at low temperature, burns instantaneously and completely, and leaves no ash. A sheet of flash paper can be destroyed in under two seconds with a match, a lighter, or even a strong spark. There is nothing to recover.
The problems are equally definitive. Nitrocellulose is a regulated explosive precursor in most jurisdictions. It is chemically unstable over long storage periods -- it degrades and can auto-ignite in storage at elevated temperatures. It is stiff and brittle when thin enough to be printable, making it fragile during transport. It is a poor surface for both inkjet and laser printing, requiring specialized offset or letterpress processes. And its mere possession, if discovered during a search, is a stronger indicator of intelligence activity than the key material it carries.
Flash paper remains the gold standard for destruction speed. It is the worst option for every other requirement.
Rice Paper
East Asian rice paper (not to be confused with the Vietnamese spring roll wrapper, which is an entirely different material) is thin, translucent, and dissolves readily in water. It has been used for concealment purposes by intelligence services across Asia for centuries. Key material printed on rice paper can be destroyed by immersion in water, chewing and swallowing, or burning.
The limitations are fragility and readability. True rice paper is extremely delicate -- it tears easily, cannot withstand repeated folding, and degrades in humid conditions. Printing fine alphanumeric grids on it requires careful calibration, as the thin, absorbent surface causes ink to spread. In conditions of high humidity, the paper itself may become translucent or tacky, making pages stick together and characters blur.
Rice paper is a good substrate for short-duration operations in controlled environments. It is a poor substrate for key material that must survive weeks of transport in a coat pocket.
Washi Paper
Washi is the broad category of traditional Japanese handmade paper. Kozo (mulberry) is a type of washi, but the term covers papers made from gampi, mitsumata, and blended fibers as well. In the context of OTP substrates, washi refers to the non-kozo varieties -- particularly gampi and mitsumata -- which have distinct properties worth evaluating independently.
Gampi washi is the aristocrat of the family. Its fibers are shorter than kozo (3 to 5 mm versus 7 to 12 mm) but finer, producing an exceptionally smooth, almost lustrous surface. This gives gampi excellent printability -- it accepts fine detail with minimal ink spread, producing sharp cipher grids at high resolution. The surface has a natural resistance to insect damage and aging, and gampi paper has been found in Japanese archives dating to the eighth century. The tradeoff: gampi cannot be cultivated (it only grows wild), making it scarce and expensive. It is also less tear-resistant than kozo -- the shorter fibers produce a more brittle sheet at equivalent weight. For a pad that will be handled extensively under field stress, this is a meaningful limitation.
Mitsumata washi sits between kozo and gampi. Its fibers are intermediate in length (4 to 6 mm), producing a soft, slightly ivory-toned sheet with good print quality. Mitsumata has been used for Japanese banknotes since the Meiji era -- a testament to its combination of durability, printability, and resistance to counterfeiting. It accepts fine printing well and is more available than gampi, though still less common than kozo. Its tear resistance is moderate: better than gampi, worse than kozo.
For OTP substrates, washi varieties other than kozo are viable but represent tradeoffs rather than improvements. Gampi offers superior print quality at the cost of availability and tear resistance. Mitsumata is a reasonable alternative where kozo is unavailable. Neither matches kozo's overall balance of strength, availability, printability, and destructibility. The burn characteristics of all washi types are similar -- thin sheets of any plant fiber ignite and consume readily -- so the destruction axis does not differentiate between them.
Water-Soluble Paper
Synthetic water-soluble paper (polyvinyl alcohol film) dissolves completely in water within seconds. It is manufactured commercially for applications ranging from embroidery backing to hospital laundry bags. It is available, inexpensive, and not suspicious to possess.
As a key material substrate, it has two significant problems. First, it is sensitive to humidity -- even ambient moisture degrades it over time, and sweat from a body-carried concealment location can begin dissolution. Second, it requires water for destruction. In a desert environment, an aircraft, or any situation where water is not immediately available, the destruction mechanism fails. You cannot burn water-soluble PVA film effectively -- it melts rather than combusts, potentially preserving printed characters in the residue.
Mulberry Paper: The Preferred Substrate
Mulberry paper -- specifically kozo paper, made from the inner bark of the paper mulberry tree (Broussonetia papyrifera) -- is the best general-purpose substrate for OTP key material. It outperforms every alternative on the overall balance of the five requirements, though it is not the best on any single axis.
Kozo fibers are extraordinarily long compared to wood pulp fibers -- 7 to 12 mm versus 1 to 3 mm for softwood pulp. This gives mulberry paper a tensile strength that is disproportionate to its weight. A sheet of 12 gsm (grams per square meter) kozo paper is thinner than tissue paper but can withstand repeated folding, handling, and even moderate moisture without tearing or delaminating. It was used for centuries in Japan for everything from shoji screens to military maps precisely because it is both light and strong.
Writability. Kozo paper accepts both inkjet and laser printing with appropriate surface sizing. Unsized kozo is too absorbent for fine printing -- ink feathers along the fibers. Lightly sized kozo (treated with a starch or gelatin surface agent) provides a controlled absorption rate that produces sharp, high-contrast characters at 600 dpi or above. It also takes pencil and pen well for handwritten annotations or check-off marks during use.
Readability. The natural color of kozo paper is warm white to cream, providing good contrast with black ink. The fiber structure creates a matte, non-reflective surface that is readable under low-angle light conditions where glossy surfaces would produce glare. At 12 to 16 gsm, it is translucent enough to see through in bright light, which could be a security concern in some contexts but is manageable with appropriate handling procedures.
Portability. A pad of 50 sheets of 12 gsm kozo paper, cut to 65 mm by 90 mm (slightly smaller than a business card), is thinner than a standard deck of playing cards and weighs under 10 grams. It folds without cracking. It does not rustle. It can be concealed in a wallet, a book spine, a belt lining, or a hollowed-out everyday object without adding perceptible bulk or weight.
Durability. Kozo paper has survived in Japanese temple archives for over a thousand years. In practical terms, it resists tearing, tolerates moderate moisture (it will not dissolve in rain or sweat), and does not become brittle with age or temperature variation. It is the most durable option on this list by a significant margin.
Destructibility. This is where kozo paper is good but not exceptional. It burns readily -- more readily than standard bond paper, due to its low density and thin profile. A single sheet of 12 gsm kozo ignites with a match and is consumed within five to eight seconds, leaving minimal ash. A stack of sheets takes longer. It does not dissolve in water (unlike rice paper or PVA film), so water-based destruction is not available. It can be chewed and swallowed in small quantities, though this is unpleasant and slow.
The destruction tradeoff is acceptable because kozo paper's burn profile is fast enough for most operational scenarios, and its superiority on every other axis justifies the compromise. For scenarios where sub-two-second destruction is a hard requirement, nitrocellulose remains the only option -- at the cost of every other property.
Entropy Sourcing for Physical Pads
The key material on the pad must be truly random. Not pseudorandom. Not "random enough." The entire security proof depends on the key being statistically independent of everything -- the plaintext, the adversary's knowledge, the time of day, the weather, the operator's habits. Any pattern, any bias, any predictability reduces the system from information-theoretically secure to something less.
For digital systems, hardware random number generators (HRNGs) based on physical phenomena -- thermal noise, shot noise, radioactive decay -- provide genuine randomness that can be verified through statistical testing. The output is a bitstream that can be converted to whatever alphabet the pad uses.
For physical pad generation, the options are more constrained.
Dice. Casino-grade precision dice provide approximately 2.585 bits of entropy per throw (log2 of 6). For a pad using the digits 0-9, you need at least 3.322 bits per digit (log2 of 10). A single die throw is not sufficient. The standard approach is to throw multiple dice and apply a rejection sampling algorithm: throw two dice, compute 6*(d1-1) + d2 to get a number from 1 to 36, reject values above 30, and map the remainder to 0-9 using modular arithmetic. This produces uniformly distributed digits with no bias, at a rate of approximately 10 usable digits per 12 throws (accounting for rejections). For a 50-page pad with 250 digits per page, that is 12,500 digits, requiring roughly 15,000 throws. This is tedious. It takes hours. It is correct.
Hardware RNG to printer. A hardware random number generator (an entropy source like an Infinite Noise TRNG or a OneRNG) produces a bitstream on a computer. Software converts the bitstream to formatted pad pages and sends them to a printer. The computer and printer are dedicated to this purpose, air-gapped, and destroyed or securely wiped after the print run. This is faster than dice by orders of magnitude and equally correct, provided the HRNG is genuine and the software conversion is unbiased.
The HRNG approach introduces a dependency: you must trust the hardware and the software. For the highest assurance applications, the dice method is preferred precisely because it has no such dependency. The randomness is physically visible -- you can watch each throw, record each result, and verify the mapping by hand. There is no hidden state, no firmware, no software, no possibility of a backdoor.
Printing Considerations
Once you have a random digit sequence, you must transfer it to the substrate. This step has its own security implications.
Inkjet printing deposits liquid ink on the surface. On sized kozo paper, it produces sharp characters with good contrast. The risk is that inkjet printers maintain internal page logs and may retain images in volatile memory. Use a dedicated printer that is never connected to a network and is physically destroyed after the print run.
Laser printing fuses toner to the surface with heat. It produces the highest contrast and most durable characters. However, many laser printers embed tracking dots -- nearly invisible patterns of yellow dots that encode the printer's serial number and timestamp on every page. These dots are a forensic identifier that links the printed pad to a specific printer. If the adversary has access to the printer or its purchase records, the tracking dots compromise the operator. Use a printer confirmed not to embed tracking dots, or print on a substrate that does not retain the dots (kozo paper's fiber structure and translucency make tracking dots extremely difficult to detect and photograph, though not impossible).
Manual transcription from dice throws directly to the pad, using a pencil, eliminates all printer-related risks. It introduces human error risk. Mitigation: transcribe with a second person reading back each digit for verification. This is slow. It is the most secure option.
Typography for Cipher Grids
The font and layout of the key material are security-relevant. A misread digit is a decryption failure. Under stress, low light, and time pressure, the characters on the pad must be unambiguous.
Use a monospaced font. Proportional fonts create irregular spacing that makes column-aligned grids harder to read and increases the probability of skipping or re-reading a digit. IBM Plex Mono is a strong choice -- it was designed specifically for technical readability, with distinct forms for commonly confused characters (0/O, 1/l/I, 5/S, 6/b, 8/B).
Print at 8 to 10 point size minimum. Smaller sizes improve portability (more digits per page) but degrade readability under poor conditions. The tradeoff depends on the operational environment. If the pad will be read under controlled lighting, 7 point is acceptable. If it may be read by flashlight in a moving vehicle, 10 point is the minimum.
Group digits in blocks of five, separated by a space. This is the universal standard for cipher text and cipher key material, because five-digit groups are the largest unit that working memory can hold as a chunk. A 25-digit line is five groups. A page of 250 digits is 50 groups arranged in 10 rows. This structure reduces transcription errors and provides natural checkpoints for the operator to verify their position.
Print row and column indices for cross-referencing. Row numbers on the left margin (01-10). Column group numbers across the top (A-E or 1-5). This allows the operator to communicate a specific starting position on the pad ("begin at row 04, group C") without transmitting key material.
Storage and Transport
Concealment
The ideal concealment renders the pad invisible to a casual search and unidentifiable as key material during a thorough search. These are different standards. A pad hidden inside a book binding defeats a casual search. But if the searcher finds it, the grid of random digits is immediately identifiable as cipher material.
Concealment strategies fall into two categories. Physical concealment hides the pad in a location the searcher does not examine: a false bottom in a container, the insole of a shoe, the spine of a hardbound book, a sealed compartment in a belt or bag. The pad must be accessible quickly -- if extracting the pad requires tools or more than a few seconds, it is inaccessible during the moments when it is needed for communication.
Disguise makes the pad resemble something innocuous. A pad printed on one side of a sheet that has a shopping list or recipe on the other. A pad formatted to resemble an account number reference card. A pad with digits arranged to mimic a calendar or phone number list. The quality of the disguise depends on how plausible the cover story is if the material is examined. A sheet of random five-digit groups next to a sheet of handwritten grocery items is suspicious. A laminated "phone contacts" card with numbers embedded in a plausible format is less so.
Tamper Evidence
You need to know if the pad has been accessed without your knowledge. An adversary who copies the key material without taking it has broken the system completely -- they can decrypt every message encrypted with the copied keys, and you will not know.
Physical tamper-evidence measures include: sealed envelopes with signatures across the seal, numbered pages that reveal if one is missing, custom binding or folding patterns that are disrupted by opening and difficult to replicate without knowledge of the pattern, and -- for highest assurance -- seals using a unique physical token (a wax seal with a custom stamp, a sticker with a unique holographic pattern, a thread sealed with a specific knot).
No tamper-evidence measure is perfect. A sophisticated adversary with time and resources can open, copy, and reseal most physical protections. The goal is not to make tampering impossible but to make undetected tampering require effort and time proportional to the value of the key material. Combine physical tamper evidence with regular pad audits -- compare pad serial numbers and page counts at both ends of the communication channel.
Destruction Methods by Substrate
Destruction is the most operationally critical phase of the key material lifecycle, because it is the phase most likely to be performed under pressure, with inadequate time, and with consequences for failure.
Burning
Burning is the primary destruction method for paper-based substrates. The requirements are: complete combustion of the printed surface, no legible residue, and verifiable completion.
For kozo paper at 12 gsm, a single page burns in five to eight seconds when ignited at one corner with a standard butane lighter. The thin fibers and low density promote rapid, complete combustion. The ash is fine, grey, and fragile -- it disintegrates on contact. Legible character recovery from properly burned kozo ash is not feasible with current forensic techniques.
For stacks, burn one to three pages at a time. A thick stack chars on the outside while pages in the interior remain intact -- this is the most common burning failure. Fanning the pages during burning accelerates combustion but requires a container (metal ashtray, tin can) to contain the burning material. An outdoor location with a slight breeze is ideal. Indoor burning requires ventilation and a fireproof surface.
For nitrocellulose, burning is instantaneous and total. No special technique is required. The material self-oxidizes and leaves no residue. This is the singular advantage of flash paper -- and the reason it remains in service for applications where destruction speed is the overriding priority.
Dissolving
Water-soluble PVA film dissolves in room-temperature water within 15 to 30 seconds. Agitation accelerates the process. The resulting solution contains dispersed ink particles that are theoretically recoverable through filtration and spectroscopic analysis, but the practical difficulty of reconstructing a character grid from dispersed ink in solution is extreme. Dilution to at least 1:100 (one sheet per 100 ml of water) and disposal of the solution eliminates any realistic recovery path.
Rice paper dissolves partially in water -- it softens and breaks down but may not fully disperse. Vigorous agitation or hot water improves dissolution. The result is a pulpy residue that should be further diluted and disposed of, not left in a basin where it could dry and partially reconstitute.
Kozo paper does not dissolve in water in any operationally useful timeframe. Water softens it but the long fibers hold together. Do not rely on water-based destruction for kozo substrates.
Ingestion
Swallowing key material is a last resort. It is possible with small sheets of thin paper -- a single page of 12 gsm kozo, 65 mm by 90 mm, can be chewed and swallowed, though it is unpleasant and slow. Rice paper and water-soluble PVA are easier to ingest. Silk and nitrocellulose should not be ingested under any circumstances.
Ingestion is not verifiable destruction. Stomach acid will destroy the paper substrate, but the transit time before destruction is complete is measured in hours, and there is no way to confirm that all ink has been rendered unrecoverable. Treat ingestion as an emergency measure that is better than the adversary having the material, but worse than proper burning.
Shredding
Mechanical shredding is insufficient for key material. Cross-cut shredders produce fragments that are recoverable. Strip-cut shredders are trivially recoverable. Even micro-cut shredders rated at DIN 66399 Level P-7 (the highest standard, producing particles of 5 mm squared or less) leave fragments that contain individual characters or short character sequences. For key material where even a partial recovery compromises the system, shredding alone is not acceptable. If shredding must be used (no fire, no water), follow it with mixing the fragments into a large volume of other shredded material and dispersing the combined waste across multiple disposal points.
Chain of Custody
Chain of custody for OTP key material follows the same principles as chain of custody for classified documents, because that is what it is. Every pad set has a serial number. Every page has a sequence number within the set. A register records which serial numbers were generated, when, by whom, and to whom each copy was issued.
At each end of the communication channel, the custodian maintains a log: which pages have been used (with dates), which pages remain, and the status of the tamper-evidence measures on the stored pad. Both custodians periodically synchronize their logs to ensure that page counts match and no pages are missing or out of sequence.
A missing page that is not accounted for by a logged message is a potential compromise. The response is to treat all remaining pages in that pad set as compromised and destroy them. Generate and distribute a new pad set. This is expensive and disruptive, which is why the physical security of the pad during storage must be airtight -- the cost of a compromise event is the entire remaining pad.
The two-person integrity principle applies throughout the lifecycle. Generation, printing, duplication, and destruction should each be witnessed by a second person who independently verifies the operation. This is not bureaucracy. It is a control against both error and insider threat. A single individual who generates, prints, and handles key material alone is a single point of compromise.
Modern Relevance
The one-time pad is not a historical curiosity. It occupies a specific and irreplaceable niche in secure communication: environments where computational assumptions are unacceptable.
Post-quantum uncertainty. Every widely deployed public-key cryptosystem (RSA, ECDH, ECDSA) is broken by a sufficiently large quantum computer running Shor's algorithm. Post-quantum replacements (lattice-based, code-based, hash-based) are based on computational hardness assumptions that have not been subjected to the same decades of cryptanalytic scrutiny. For communications that must remain secret for 50 years or more -- diplomatic archives, intelligence assessments, strategic planning documents -- the OTP is the only system that provides security independent of any assumption about future computational capability.
Air-gapped environments. Facilities with strict air-gap requirements need authentication and communication mechanisms that do not depend on digital key infrastructure. Physical OTP material provides a bootstrap mechanism: the first authenticated communication over a new channel can be secured by pre-positioned key material, establishing trust before any digital key exchange occurs.
Backup authentication. When the primary authentication system fails -- network outage, HSM failure, compromised certificate authority -- organizations need a fallback that works with no infrastructure dependencies. Pre-distributed OTP codes, stored in sealed envelopes in physical vaults, provide emergency authentication that cannot be compromised by any digital attack. This is how nuclear command authority has been authenticated since the 1960s, and the approach has not been improved upon because there is nothing to improve. The physics is correct.
Adversarial environments. Personnel operating in jurisdictions where electronic devices are subject to seizure, inspection, or covert compromise need communication methods that leave no digital footprint. A pad of paper, used and destroyed, leaves no metadata, no log entries, no recoverable deleted files, no electromagnetic emissions. The operational security surface is physical, which is a surface that trained personnel can manage through established tradecraft.
The one-time pad is expensive, logistically demanding, and impractical for high-volume communication. It will never replace AES for encrypting web traffic. That is not its purpose. Its purpose is to provide provable secrecy for low-volume, high-consequence communication in environments where the operational cost is justified by the threat model. For that purpose, the choice of substrate -- the physical medium that carries the key, survives the journey, and disappears when it must -- is not a detail. It is the entire system.