One Time Pads and "Bit Flip" Attacks
accepted wisdom that OTP encrypted messages are secure &amp; unbreakable


OTP encrypted messages are secure &amp; unbreakable assuming the pad is secret, uniformly random, and not reused... and the message does not otherwise leak! The last point is where the "Bit Flip" attack comes to play.

Imagine the message is conventionally a digit send in ASCII, and parsed as such by the receiver after decryption; and that the context tells the adversary that a particular message is 1 or 2, that is the bitstring 00110001 or 00110010. With the OTP (or a stream cipher), the adversary can flip the 5th bit of ciphertext, and know that changes the plaintext to 00111001 or 00111010, that is the character 9 or :. Now if the adversary can sense whether the receiving system accepts the result as a digit, or rejects it, the confidentiality is lost!

More generally, when users of cryptography need encryption for confidentialitty, they tend to additionally need assurance of integrity and origin. The OTP only gives confidentiality, and as illustrated not unconditionally in some quite practical cases.

However, assurance of integrity can be obtained with an information-theoretic substitude to a MAC, or universal hash, such as Carter-Wegman; and when the OTP is shared among only two parties that gives assurance of origin. That consumes some of the OTP, but manageably so. And it can help mitigate the above attack (an altered message will be rejected before it is tested that it is decimal).

There remains two reasons making the OTP impractical:


It is easy for an adversary to mount a denial of service attack that de-synchronize sender and receiver (that can be solved to a degree, but is not trivial)
The random pad must be sent in advance by secure means, and kept secret on both sides.