Xjyuk

So I've been reading about cryptography and one-time pads, which seem to provide theoretically perfect secrecy. My question is does any form of technology today allow data to be stored in a practical way such that information is destroyed upon reading it? I think that magnetic core memory works in a similar way:

To read the value of a core, the core was flipped to the 0 state. If the core was in 1 state previously, the changing magnetic field produced a voltage in the sense wire threaded through the cores. But if the core was in the 0 state to start, the sense line wouldn't pick up a voltage. Thus, forcing a core to 0 revealed the core's previous state (but erased it in the process)

Text source

There are two paths that would be possible without doing something exotic.

Erase the actual bits

Blow the bank.

• Erase: When I make analog floating-gates, I use classical physics to program them (put charge on the gate) and a quantum effect of tunneling to pull charge off (make the gate positive). I could tunnel and read concurrently which would erase the bank. This would allow the memory to be reusable and volatile on read. You cannot get the information back.




• Blow: When we make digital memory, we read banks. 64k is one of my tiles, the other is 1M. It just depends on who made the blocks. I could make the "read" counter tied to an overflow that would blow an e-fuse. You could repair this (with a lot of cost).

Practically speaking, I think that - in the realm of cryptography - a HSM is the closest that you can get. A HSM is a tamper-proof box that destructs or disables the keys and data stored within it when it detects distortion.

Of course a HSM is a practical device; it doesn't provide information theoretic certainty that the information will be destroyed. Although it operates as a black box, it is still a physical device and there are certainly attack vectors on it. Internally it is just a computer in a tamper resistant box. These expensive devices are protected against many kinds of side channel attack. They also try and resist transport, by detecting movement and by destroying all data if the power is removed from them (they commonly include a battery / ultra capacitor to store power to do so, or they rely on volatile RAM in the first place. There are cheaper / more limited devices that simply rely on a smart card chip to perform the same functionality; these often are in the form of a largish USB-stick.

One trick you can perform once you have a secure key store that provides cryptographic operations on the keys is to encrypt data with such a key. You could put a limit on the key usage, say 2 - once for writing, once for reading - for symmetric keys, or just 1 usage for a private key decryption. That way the device will prevent user access to the key once it is used to (partially) decrypt the data. As long as the encryption algorithm stays secure, it will become practically impossible to decrypt any data protected by that particular key.

Of course, the entity that just read the data now has the responsibility of keeping the information confidential. I can read a book and then burn it, but now the information in the book is (partially and inefficiently) stored in my memory after all. Reading data does mean that the data is duplicated in another location; reading fundamentally doesn't seem to be destruction of information, rather the propagation of information.

In short, no, I don't think we have a way to do this, but cryptography can certainly help by limiting the requirements for destruction to just a key rather than, for instance, a disk full of information.

A system that I've worked on uses a spinning hard disk (not SSD or hybrid). The OTP key material is stored on the disk and there is also the outbound encrypter application. When the application is launched, the very first thing it does is to read a single file of key material off the disk. It then immediately erases it by over writing. It does this no matter what happens next, so if you choose not to compose and send a message, you've lost that key material. Also if the application crashes or hits a snag, you've lost that key material. So it's one key file per encrypter invocation.

For the inward case, the decrypter application immediately over writes the key file that matches the inbound message IV (which serves as the filename). If you close the application, forget the message or it faults, you can't get the message back as the key material is gone.

If the user is willing to get on board with the usage protocol, it's the closest I can think of to a read once key store. The system relies on a modicum of user discipline and a hard disk full of material generated via your own trusted TRNG. A few thousand key files should last a while if you're using the OTP in an appropriate manner. And it does mimic a nitro-cellulose OTP booklet in that the operator would destroy the relevant page upon use, but the remaining pages could still fall into enemy hands.

This is clearly a (poor?) compromise but perhaps a little more practical than core storage. And of course it can't be used on non rotary media.

Ferroelectric RAM is a modern analog to magnetic core memory, from the standpoint that reading it looses the information previously stored (source). Usually there is on-die write-after-read circuitry to prevent information loss (much like that was built in core memory controllers). If that circuitry was removed we'd get a read-once memory.

On the other hand, it is quite possible that a forensic examination of the memory cell with sensitive-enough instruments (Scanning Tunneling Microscope perhaps) would allow recovery of the previous information even after a read; and there's noting to prevent externally making a copy of the information read.

There is a very practical way to do something essentially equivalent to storing a long one-time pad: store a 32-byte key $k$, and when you need a page of pad material, take the first 32 bytes of $operatornameChaCha(k)$ as a new key, replacing $k$ in memory, and the remaining bytes—up to about a zettabyte—as your pad.

Voilà! As long as you overwrite the key each time and never leave copies lying around elsewhere, you can extremely efficiently store more bytes of pad material than you can ever use this way, and nobody can ever recover old pads unless you made copies of them elsewhere.

This method is so practical that your computer is probably actually doing it—or a similar technique using AES—right now with the crypto.stackexchange.com web server!