&gt;Also, no forward secrecy.<p>My understanding of OTP&#x27;s implies that these must be used only once. As such they offer the same PFS as all the schemes I know of. PFS does not guarantee the secrecy of a specific message. It does guarantee that if you are able to crack one message you can&#x27;t use the key to crack others. Therefore if you use an OTP only once it gives you the same guarantees.