# Word-based stream ciphers vs “regular” stream ciphers?

Could somebody explain what is the difference between "word-based" stream ciphers and the regular ones? Those last ones use pseudo-random sequences XOR'd bit by bit with the message, as far as I know. How does that change when it comes to "word-based" ciphers?

Examples of word based keystream ciphers include SNOW, PANAMA, SOBER, ORYX. I also read that word based keystream ciphers "allow greater efficiency in software than most bit based stream-ciphers".

-
Would you care to provide a citation for your quotes? I don't think it is accurate to say that "less is known about the security of word-based stream ciphers than bit-based stream ciphers". –  D.W. Nov 15 '12 at 2:35
Yes, they are from Analysis and Design Issues for Synchronous Stream Ciphers by Dawson and Simpson in Lecture Notes Series, Insititute for Mathematical Sciences, National University of Singapore written in 2002. –  geo909 Nov 15 '12 at 15:15
@D.W. You are right! I just realized I misread! There was a small part saying that "ORYX was found to be a seriously flawed design" but much less is known about the security of the rest of the above mentioned word based stream ciphers (i.e. SNOW,PANAMA,SOBER,ORYX), not all stream ciphers in general. Thanks for pointing that out! I removed that part of the question. –  geo909 Nov 15 '12 at 15:18

A word-based stream-cipher produces the pseudo-random sequence one word (of several bits) at a time. For example RC4 is a word-based stream cipher, with the word size a byte. By contrast, a typical bit-based stream cipher such as one using the ASG produces the pseudo-random sequence one bit at a time.

Word-based stream ciphers may be better suited to fast software implementations than are bit-based stream ciphers, since CPUs typically process one word no slower than one bit.

-
I don't have enough reputation to vote this up, but it answers my question, many thanks.. I was also wondering how one could compare word-based stream ciphers and block ciphers. I do not know much about block ciphers so there may be a very basic and fundamental difference that I do not see, however I can tell that they process blocks of bits at a time, so it seems that they are similar to woed-based stream ciphers in that sense? What is the difference? –  geo909 Nov 14 '12 at 20:11
@geo909: A stream cipher XOR the plaintext and keystream, and thus has the property $\mathtt{Enc}(P')=\mathtt{Enc}(P)\oplus P'\oplus P$. A block cipher does an arbitrary-looking permutation of plaintext block to ciphertext block, not bound by this property. That makes block ciphers versatile building blocks for all kinds of constructs: stream ciphers (using the CTR or OFB mode), MAC, hashes. Ah, also: even without reputation, you should still be able to accept an answer. –  fgrieu Nov 15 '12 at 6:52
I'm not sure what $P'$ is but I do understand the difference now, thanks. I guess regular stream ciphers are more efficient in hardware implementation that block ciphers in CTR or OFB mode, right? –  geo909 Nov 15 '12 at 15:41
@geo909: $P'$ would be an alternate plaintext. The stated property allows computing the ciphertext for $P'$ from $P$, $P'$, and the ciphertext for $P$. This is a case of malleability. Efficiency of implementation depends on many factors, e.g. resistance to side-channel attacks, thus comparisons are hard; but at least one argument of the proponents of bit-based stream ciphers is that they are more efficient in hardware than block ciphers in CTR or OFB mode. –  fgrieu Nov 15 '12 at 16:23

From your perspective as a user of stream ciphers, the distinction is irrelevant.

As a driver of a car, you don't need to care the details of how the car's engine was built. What you care about is whether the car gets you there safely and rapidly.

Similarly, from your perspective as a user of a stream cipher, what you care about is whether the stream cipher is secure and how fast it is. If you measure those two things, you don't need to care about which type the stream cipher is.

Generally speaking, word-based stream ciphers are often built that way because operating on a word at a time can potentially be faster in software (on the other hand, bit-based stream ciphers can potentially be better in hardware, e.g., use less power and less silicon). However, rather than worry about this detail, you should just measure how fast the stream cipher actually is, and make your decision based upon that -- as well as whether the stream cipher offers sufficient security.

-
You are right about the car user analogy but my perspective is not exactly the driver's. I'm studying finite fields focusing on the non-applied side, however I wanted to have a small look on the applications and see how exactly finite fields are used and why we prefer this or that in cryptography. That is, I am mostly interested to have a sneak peak on the engine rather than going for a ride :) –  geo909 Nov 15 '12 at 15:29