New Ideas on a New Old Type of Cipher: The Mixed-Radix One-Time Pad Fabio F.G. Buono Independent Researcher
arXiv:2606.16040v1 [cs.CR] 14 Jun 2026
June 16, 2026
Abstract In a short 2012 preprint, an unconventional cipher was introduced, now in this note we take that representational core, formalize it, and use it as the basis for a clean generalization of the one-time pad to non-uniform bases, which we call the Mixed-Radix One-Time Pad (MR-OTP). And we prove that the MR-OTP achieves Shannon perfect secrecy, show that the classical binary OTP is exactly the all-bases-equal-2 special case, and that fixed-base variants recover OTPs over arbitrary alphabets. We then examine whether secret bases can lower the key entropy required for perfect secrecy (they cannot). We close with a usable session protocol based on key rolling that preserves perfect secrecy, and with an honest account of the open problems. Preprint
1
Introduction
Everything starts from the preprint A New Type of Cipher [2], its underlying idea is that an integer can be decomposed, by repeated Euclidean-style division against a chosen sequence of decreasing divisors, into a sequence of quotients. This is, in essence, a representation of the integer in a system of mixed bases (a mixed-radix numeral system). The preprint remained an undeveloped sketch and, to our knowledge, has not been cited. In this note we extract it, formalize it cleanly, and build on it. Our contributions are: (i) We formalize the mixed-radix representation underlying [2] and define the Mixed-Radix One-Time Pad (MR-OTP), the natural one-time pad over a mixed-radix digit system (Section 2). (ii) We prove that the MR-OTP satisfies Shannon perfect secrecy, and that it is correct (i.e., decryption is the exact inverse of encryption). We show the classical binary OTP is the special case where every base equals 2, and that any constant base b recovers the OTP over an alphabet of size b (Section 3). (iii) We state and resolve a tempting conjecture: that secret bases might let the messagecovering key be shorter than the message while retaining perfect secrecy. We show this is false in the strong (information-theoretic) sense, and explain precisely why, it would break the uniformity hypothesis that the secrecy proof requires (Section 4). (iv) We describe a usable session protocol based on key rolling that preserves perfect secrecy, in which the mixed bases provide encoding efficiency and adaptivity rather than a reduction in key length (Section 5).
1
2
The Mixed-Radix Representation and the MR-OTP
2.1
Mixed-radix representation
Fix a length L and a sequence of bases B = (b1 , . . . , bL ) with each bi ≥ 2. The digit space is L Y DB = {0, 1, . . . , bi − 1}. i=1
A message M is identified with its digit tuple (m1 , . . . , mL ) ∈ DB , where 0 ≤ mi < bi . With positional weights Y Wi = bj , WL = 1, j>i
PL
Q the tuple corresponds to the integer i=1 mi Wi , and conversely every integer in {0, . . . , i bi −1} has a unique such representation. This is the mixed-radix numeral system, and it is the “cleanedup” form of the decreasing-divisor decomposition of [2], with the bases playing the role of the divisors but without the side constraints (decreasing order, remainder handling) that made the original sketch awkward to analyze.
2.2
The cipher
Definition 1 (MR-OTP). Let B = (b1 , . . . , bL ) be a fixed sequence of bases with bi ≥ 2. The key space is L Y K = {0, 1, . . . , bi − 1}, i=1
and a key K = (k1 , . . . , kL ) is drawn uniformly at random from K. Encryption of a message M = (m1 , . . . , mL ) is performed digitwise: ci = (mi + ki ) mod bi ,
C = (c1 , . . . , cL ).
Decryption, given K, is mi = (ci − ki ) mod bi . So the construction is the obvious analogue of the binary OTP, with bitwise XOR replaced by digitwise addition modulo bi in each (possibly distinct) base.
3
Perfect Secrecy and Correctness
3.1
Correctness
Proposition 1 (Correctness). For every key K ∈ K and every ciphertext C, decryption returns the unique message M that is encrypted. Proof. For each position i, the map x 7→ (x + ki ) mod bi is a translation on the finite cyclic group Zbi , hence a bijection, with inverse x 7→ (x − ki ) mod bi . Therefore ci determines mi uniquely given ki , and the tuple C determines M uniquely given K.
3.2
Perfect secrecy
We use Shannon’s definition [5]. Definition 2 (Perfect secrecy). A cipher has perfect secrecy if for every message distribution P[M ] and every ciphertext c with P[C = c] > 0, P[M = m | C = c] = P[M = m] 2
for all m.
Theorem 1 (Perfect secrecy of the MR-OTP). The MR-OTP with a uniformly random key over K has perfect secrecy. Proof. We compute the three quantities of Bayes’ rule. Step 1: the conditional P[C = c | M = m]. Fix a position i and fix mi , ci . The equation ci = (mi + ki ) mod bi has exactly one solution ki ≡ (ci − mi ) (mod bi ) in {0, . . . , bi − 1}. Since ki is uniform on {0, . . . , bi − 1}, 1 P[ci | mi ] = . bi The key digits k1 , . . . , kL are chosen independently, so the events across positions are independent given M , and L L Y Y 1 , P[C = c | M = m] = P[ci | mi ] = bi i=1
i=1
which does not depend on m. Step 2: the marginal P[C = c]. By the law of total probability and Step 1, P[C = c] =
X
′
′
P[C = c | M = m ] P[M = m ] =
L Y
m′
1 bi
X
P[M = m ] =
m′
i=1
′
L Y 1
b i=1 i
,
P since m′ P[M = m′ ] = 1. Step 3: the posterior. By Bayes’ rule, P[C = c | M = m] P[M = m] P[M = m | C = c] = = P[C = c]
Q
1 i bi
P[M = m] = P[M = m], Q 1 i bi
for all m, c. This is perfect secrecy. Remark 1. About the independence of the key digits, invoked in Step 1, it is what makes the per-position factor 1/bi multiply into a message-independent product. The uniformity of each ki over the entire set {0, . . . , bi − 1} is equally essential; we return to this point in Section 4.
3.3
The OTP as a special case
Corollary 1 (Binary OTP). With bi = 2 for all i, the MR-OTP coincides exactly with the classical binary one-time pad. Proof. With bi = 2 we have mi , ki ∈ {0, 1} and ci = (mi + ki ) mod 2 = mi ⊕ ki , addition modulo 2 being exactly XOR. Hence C = M ⊕ K bitwise, the definition of the binary OTP. Corollary 2 (Single-alphabet OTP). With bi = b constant for all i, the MR-OTP is the onetime pad over an alphabet of size b (e.g. b = 26 for the Latin alphabet, b = 4 for a four-symbol alphabet such as nucleotide data). Proof. With bi = b for all i, the digit space becomes {0, . . . , b − 1}L , encryption is ci = (mi + ki ) mod b, and the cipher is exactly the one-time pad over an alphabet of size b. These corollaries position the MR-OTP as a generalization rather than a rival of the onetime pad and the classical and single-alphabet pads are recovered as points in a family, and the truly new territory is that of mixed (non-constant) bases, where the digit system can be matched to the structure of the data being encrypted.
3
4
Can Secret Bases Reduce the Required Key Entropy?
A natural hope is that, by treating the bases B as part of the secret key, one might get away with a message-covering key shorter than the message while keeping perfect secrecy, the longstanding dream of a “perfect cipher with short keys.” We make the question precise and show the answer is negative.
4.1
Setup
Now suppose the key has two parts, K = (B, k), where B = (b1 , . . . , bL ) is now secret and k = (k1 , . . . , kL ) is the additive pad with ki ∈ {0, . . . , bi − 1}. Write H for Shannon entropy. The entropy of the key decomposes as H(K) = H(B) + H(k | B). Given B, and we assuming, as required for perfect secrecy, that k is uniform and independent given B, a uniform pad contributes L X
H(k | B) =
log2 bi ,
i=1
while the message, living in DB , satisfies H(M ) ≤
L X
log2 bi ,
i=1
with equality when M is uniform.
4.2
The accounting identity and what it does not buy
Combining the above, H(K) = H(B) + H(k | B) ≥ H(M ). | {z } | {z } ≥0
≥H(M )
This inequality is consistent with the Shannon bound H(K) ≥ H(M ) for theP perfect secrecy [5], but it is merely an accounting identity: the pad k already carries entropy i log2 bi ≥ H(M ) on its own, and the base entropy H(B) sits on top of the requirement. Proposition 2 (Secret bases cannot substitute for pad entropy). Suppose the MR-OTP retains perfect secrecy. Then the pad k must, on each position i, be uniform over the full set {0, . . . , bi − 1}, and hence H(k | B) ≥ H(M ). In particular, base entropy H(B) cannot be used to make k shorter than what is required to cover H(M ). Proof. The secrecy proof of Theorem 1 requires, at Step 1, that for each i the digit ki be uniform over the whole of {0, . . . , bi − 1}. This is what forces P[ci | mi ] = 1/bi independently of mi . If on some position the pad fails to range uniformly over {0, . . . , bi − 1}, which is what “shortening k below the message length” necessarily entails for at least one position, then the conditional P[ci | mi ] depends on the mi , the product no longer factors into a message-independent constant, and the posterior need no longer equal the prior, thus the perfect secrecy fails. Knowing or hiding B is irrelevant to this argument, since the failure is on the pad coordinate. The upshot is positive in its own way, as secret bases do not lower the information-theoretic key requirement, and whatever additional protection they might provide is computational in nature and outside the scope of this note. So an adversary who does not know B faces a search problem over the base space before any decryption attempt, and whether this constitutes meaningful computational security remains an open question. 4
5
Perfect Secrecy with Key Rolling as an Usable Protocol
The practical objection to any one-time pad is key distribution. The MR-OTP inherits this: by Proposition 2, perfect secrecy still demands pad material at least as long as the message. What the mixed-radix structure adds is not shorter keys but encoding efficiency and adaptivity. We make this precise via a key-rolling session protocol.
5.1
Construction
Alice and Bob share, once and offline, an initial key K0 . We partition (never reuse) K0 and its successors. At session t, the active key segment is split as msg Kt = Ktmsg ∥ Bt+1 ∥ Kt+1 ∥ ...,
where ∥ denotes concatenation of disjoint key material. Session t proceeds as: 1. Encrypt Mt as an MR-OTP under bases Bt and pad Ktmsg , where |Ktmsg | covers H(Mt ) in full. msg 2. Read off the next bases Bt+1 and the next pad segment Kt+1 from disjoint, never-beforeused portions of the shared key material.
3. Session t + 1 uses bases Bt+1 , chosen to match the expected structure of Mt+1 .
5.2
Why this preserves perfect secrecy
Because every pad segment and the every base segment is taken from disjoint, previously unused key material, no key bit ever encrypts more than its own entropy’s worth of content. The protocol is thus a partitioned one-time pad, where each session is an independent MR-OTP to which Theorem 1 applies directly. The crucial discipline is that the material used to convey msg is never the same material used to encrypt Mt , as reusing it would make some Bt+1 and Kt+1 key segment cover more than its entropy and would break secrecy as in Proposition 2
5.3
Role and limits of adaptive bases
There are two distinct ways adaptive bases might be understood, and conflating them is the classic error. Encoding efficiency (always safe). Choosing Bt+1 to match the alphabet of Mt+1 (e.g. base 26 for text, base 4 for nucleotide data) lets the message be represented natively, without padding or artificial binary conversion. The pad still covers H(Mt+1 ) in full; secrecy is unaffected. The gain is representational convenience. Entropy reduction (conditional, and dangerous). Choosing Bt+1 because one P assumes Mt+1 is non-uniform—and then shortening the pad to the assumed H(Mt+1 ) < i log2 bi — can be consistent with Shannon only if the message model is exact. If the real message deviates from the assumed model, perfect secrecy is lost. This is precisely the trap that has sunk many proposed “usable perfect” ciphers. We therefore recommend, and analyze, adaptive bases strictly in the first sense: efficiency and flexibility, not a covert reduction of key length.
5
5.4
Key consumption and overhead of base transmission
Because the bases Bt+1 are themselves transmitted using fresh key material, their encoding has a cost that must be accounted for. Suppose each base bi requires at most β bits to represent in the shared key (where β depends on the agreed-upon base alphabet, but is left as a parameter here to keep the result general). Then the total key material consumed per session t is L X i=1
|
log2 bi + Lβ , |{z} bases {z }
pad
and the overhead fraction relative to the pad is Lβ/
P
i log2 bi . This overhead is negligible when
L
1X log2 bi ≫ β, L i=1
that is, when the average base is large relative to its own representation cost. In typical cases of interest (e.g. bases matched to natural-language or biological alphabets, where bi ≥ 4) this condition holds comfortably. In the degenerate case bi = 2 for all i, the overhead equals the pad length and the mixed-radix structure provides no representational gain over the binary OTP, as expected.
6
Connections and Context
Q Relation to the OTP over finite abelian groups. The key space K = i Zbi is a finite abelian group under componentwise addition, and the MR-OTP is the one-time pad on this group. The perfect secrecy of OTPs over finite abelian groups is a classical fact, so the MROTP is, algebraically, a special case of a well-known construction. What the mixed-radix perspective adds is the explicit identification of the group with the integer representation of a message: the digit structure connects the algebraic object to the numeral system, and it is this connection that makes the encoding efficiency of Section 5 and the arithmetic coding analogy below natural rather than coincidental. Mixed-radix numeral systems and Diophantine approximation. Non-uniform positional systems are classical. The factorial number system (bi = i + 1) is standard [1], and Ostrowski’s numeration [3] associates to the continued-fraction expansion of an irrational α a mixed-radix system whose digit bounds are the partial quotients; for α the golden ratio this specializes to the Zeckendorf (Fibonacci) representation. Our digit system is a finite-length, fixed-base instance of this much older and richer theory. The MR-OTP adds a cryptographic reading of these systems, not new number theory. Arithmetic coding and entropy. The “adaptive bases” of Section 5, in their safe (encoding) sense, are in the spirit of arithmetic coding, where a message is represented in a numeral system matched to the source so that the representation length approaches the source entropy. Rissanen’s early work [4] on generalized Kraft inequalities is a precursor to this line of ideas. Choosing bi to fit an alphabet is a special, coarse case of this general technique. The link is real and useful, but it places the construction inside a mature area of information theory rather than beside it. What is not hidden here. Q Before closing this section it is worth noting that the coincidence of the digit-space cardinality i bi and the state count of L independent finite systems (with Q P log i bi = i log bi ) is simply the additivity of the logarithm, and that perfect secrecy, being information-theoretic, attaches to no complexity-class statement. 6
7
Conclusion and Open Problems
We formalized the representational idea of [2] as the Mixed-Radix One-Time Pad, proved perfect secrecy and correctness, and showed that secret bases cannot reduce the information-theoretic key requirement. We gave a key-rolling protocol that keeps perfect secrecy while using mixed bases for encoding efficiency, and characterized the key consumption overhead of base transmission. The main open questions are the average-case hardness of base recovery, optimal base selection for structured sources, and composability of the rolling protocol across sessions and parties.
8
Final Remarks
Remark 2. By Shannon’s theorem, any perfectly secret cipher must satisfy |K| ≥ |M|. The MR-OTP meets this condition by construction, since K = DB = M, so the key space and the message space coincide. Remark 3. The MR-OTP achieves the tightest possible case of the Shannon’s bound, as for any pair (M, C) there is just one key K ∈ K, namely ki = (ci − mi ) mod bi for each i, so no key material is wasted.
References [1] Jean-Paul Allouche and Jeffrey Shallit. Automatic Sequences: Theory, Applications, Generalizations. Cambridge University Press, 2003. URL: https://www.cambridge.org/ 9780521823326. [2] Fabio F. G. Buono. A new type of cipher, 2012. arXiv:1202.2004, https://arxiv.org/ abs/1202.2004. arXiv:1202.2004. [3] Alexander Ostrowski. Bemerkungen zur theorie der diophantischen approximationen. Abhandlungen aus dem Mathematischen Seminar der Universität Hamburg, 1, 1922. doi: 10.1007/BF02940581. [4] Jorma J. Rissanen. Generalized kraft inequality and arithmetic coding. IBM Journal of Research and Development, 20(3), 1976. doi:10.1147/rd.203.0198. [5] C. E. Shannon. Communication theory of secrecy systems. Bell System Technical Journal, 28(4), 1949. doi:10.1002/j.1538-7305.1949.tb00928.x.
7