Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A (synchronous) stream cipher is an algorithm which maps some fixed-length key to an arbitrary-length key-stream (i.e. a sequence of bits): $C : \{0,1\}^k \to \{0,1\}^{\infty}$.

This key-stream is then XOR-ed with the plain text stream, giving the ciphertext stream. For decrypting, the same key-stream (generated from the key at the receiver side) will be XOR-ed with the ciphertext stream, giving again the key stream.

A One-time pad is an algorithm which takes a key of large size (at least message size), and XORs its start with the plaintext to get the ciphertext. For decryption, we XOR the start of the key with the ciphertext to get back the plaintext.

These look quite similar – could one say that a stream-cipher is a (special way to create/use a) one-time pad, or that the one-time pad is a kind of stream cipher?

Are there any important differences between these two classes of algorithms?

share|improve this question
up vote 8 down vote accepted

There is no universally accepted definition of the expression "stream cipher"; but the one I most often encounter is the following: a stream cipher is a symmetric encryption algorithm which accepts as inputs arbitrary sequences of bits (or bytes) such that:

  • the length of the output is equal to the length of the input (no padding);
  • for any $n$ (possibly any $n$ which is a multiple of 8 if we restrict ourself to bytes), the first $n$ output bits depend only on the key and the first $n$ input bits, regardless of the value of the subsequent input bits.

In that sense, the One-Time Pad is a stream cipher. A block cipher used in CTR mode or CFB mode is also a stream cipher. Note that the latter is not of the kind "XOR with a stream generated from the key independently of the input data". The Wikipedia page you link to talks about "synchronous stream ciphers" and "self-synchronzing stream ciphers".

However, the ultimate security of the One-Time Pad comes from the key size: it is unbreakable because it assumes that the key is as long as the message and was generated by an unpredictable mechanism. If you generate the pad with a more conventional stream cipher, working over a small fixed-size key, then it is no longer a One-Time Pad, just a "regular" stream cipher. The expression "One-Time Pad" refers to, exclusively, the mythical scheme which uses truly random long keys. So while One-Time Pad is a stream ciphers, stream ciphers are not One-Time Pads.

share|improve this answer
Also note that a computationally unbounded adversary could break a stream cipher (having enough known plaintext) but not a one-time pad. – Henno Brandsma Sep 27 '11 at 19:32
Since the one-time-pad was actually used, it is not mythical. For example, the original Moscow–Washington hotline starting in 1967 used a one-time pad. – David Cary Oct 17 '11 at 12:11
@David: I have no detail on how the pads were generated. The "red phone" had the operational constraints of a one-time pad (namely requiring weekly distribution of large keys on tapes) but unless the pads were generated with a 100% physical RNG, it was not a "true" one-time pad. – Thomas Pornin Oct 17 '11 at 12:50
The one-time pad and Venona project articles say that the USSR and a few other organizations heavily used physical pads of random-looking letters called one-time pads. I think it's pretty likely that practically all of those pads were, in fact, generated with a 100% physical RNG, although I don't really have any evidence one way or another. I suspect that we may never know exactly how those pads were generated. – David Cary Jul 30 '12 at 17:25

One important difference between the one-time pad and a stream cipher is the proof of security of the one-time pad. Shannon proved that the one-time pad provides perfect secrecy. He also provided another proof that is interesting to this dicussion. His proof was that no cipher can provide perfect secrecy unless the key is at least a long as the message. Therefore, we know that no stream cipher can provide perfect secrecy unless it meets that requirement. But, just because it meets that requirement does not mean that it automatically provides perfect secrecy.

Now, as to whether or not they are the same, the answer is no. The one-time pad uses a fixed length key (where the length is at least a long as the message among other requirements) and the xor operation, period (i.e., there is no key expanion/stream generation).

share|improve this answer

Mathematically speaking. The entropy of a stream cipher is upper-bounded by the key size.

The entropy of a one time pad, on the other hand is upper-bounded by the plaintext size.

For true one-time pads and good stream ciphers, this bound is tight.

share|improve this answer
How is the term "entropy" defined for a cipher (i.e. an algorithm)? (I only know it as a measure of randomness for data, apart from the termodynamic meaning.) – Paŭlo Ebermann Jul 6 '13 at 21:06

the stream cipher is similar to the one-time pad but exact difference is that
one-time pad uses a genuine random number stream, whereas a stream cipher uses a pseudorandom number stream
pseudorandom numbers calculated by a computer through a deterministic process, cannot, by definition, be random. Given knowledge of the algorithm used to create the numbers and its internal state, you can predict all the numbers returned by subsequent calls to the algorithm,
whereas with genuinely random numbers, knowledge of one number or an arbitrarily long sequence of numbers is of no use whatsoever in predicting the next number to be generated.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.