Number Stations 2.0: Information-Theoretic Asynchronous Messaging via Public-Receive SMS Infrastructure

We present Number Stations 2.0, a covert messaging protocol that achieves information-theoretic security by encrypting one-time-pad ciphertext into the format of standard mobile-phone one-time password (OTP) codes and depositing it on public-receive-SMS aggregator services. Because legitimate OTP codes are six-to-eight digit numeric strings drawn from a uniform distribution, and because our protocol's encrypted output is by Shannon's theorem indistinguishable from a uniform distribution, an adversary observing all traffic on these public services cannot statistically distinguish encrypted protocol messages from legitimate OTP traffic with advantage greater than zero. The protocol requires no infrastructure operated by the system designers, hides in a multi-thousand-message-per-hour stream of legitimate OTP traffic, and provides plausible deniability proper. We describe the protocol, prove its security properties under standard cryptographic assumptions, and reference a deployed reference implementation.