# What is the difference between a stream cipher and a one-time-pad?

A (synchronous) stream cipher is an algorithm which maps some fixed-length key to an arbitrary-length key-stream (i.e. a sequence of bits): $C : \{0,1\}^k \to \{0,1\}^{\infty}$.

This key-stream is then XOR-ed with the plain text stream, giving the ciphertext stream. For decrypting, the same key-stream (generated from the key at the receiver side) will be XOR-ed with the ciphertext stream, giving again the key stream.

A One-time pad is an algorithm which takes a key of large size (at least message size), and XORs its start with the plaintext to get the ciphertext. For decryption, we XOR the start of the key with the ciphertext to get back the plaintext.

These look quite similar – could one say that a stream-cipher is a (special way to create/use a) one-time pad, or that the one-time pad is a kind of stream cipher?

Are there any important differences between these two classes of algorithms?

-

There is no universally accepted definition of the expression "stream cipher"; but the one I most often encounter is the following: a stream cipher is a symmetric encryption algorithm which accepts as inputs arbitrary sequences of bits (or bytes) such that:

• the length of the output is equal to the length of the input (no padding);
• for any $n$ (possibly any $n$ which is a multiple of 8 if we restrict ourself to bytes), the first $n$ output bits depend only on the key and the first $n$ input bits, regardless of the value of the subsequent input bits.

In that sense, the One-Time Pad is a stream cipher. A block cipher used in CTR mode or CFB mode is also a stream cipher. Note that the latter is not of the kind "XOR with a stream generated from the key independently of the input data". The Wikipedia page you link to talks about "synchronous stream ciphers" and "self-synchronzing stream ciphers".

However, the ultimate security of the One-Time Pad comes from the key size: it is unbreakable because it assumes that the key is as long as the message and was generated by an unpredictable mechanism. If you generate the pad with a more conventional stream cipher, working over a small fixed-size key, then it is no longer a One-Time Pad, just a "regular" stream cipher. The expression "One-Time Pad" refers to, exclusively, the mythical scheme which uses truly random long keys. So while One-Time Pad is a stream ciphers, stream ciphers are not One-Time Pads.

-
Also note that a computationally unbounded adversary could break a stream cipher (having enough known plaintext) but not a one-time pad. – Henno Brandsma Sep 27 '11 at 19:32
Since the one-time-pad was actually used, it is not mythical. For example, the original Moscow–Washington hotline starting in 1967 used a one-time pad. – David Cary Oct 17 '11 at 12:11
@David: I have no detail on how the pads were generated. The "red phone" had the operational constraints of a one-time pad (namely requiring weekly distribution of large keys on tapes) but unless the pads were generated with a 100% physical RNG, it was not a "true" one-time pad. – Thomas Pornin Oct 17 '11 at 12:50
The one-time pad and Venona project articles say that the USSR and a few other organizations heavily used physical pads of random-looking letters called one-time pads. I think it's pretty likely that practically all of those pads were, in fact, generated with a 100% physical RNG, although I don't really have any evidence one way or another. I suspect that we may never know exactly how those pads were generated. – David Cary Jul 30 '12 at 17:25
And let's not forget that Numbers Stations also send OTP encrypted messages too. Venona was an effort to decode Cuban Numbers Stations which turned out be reusing pads. That is the only reason they got cracked. That and some agents did not dispose of used pads correctly as well. – WAR10CK Feb 24 at 15:26

One important difference between the one-time pad and a stream cipher is the proof of security of the one-time pad. Shannon proved that the one-time pad provides perfect secrecy. He also provided another proof that is interesting to this dicussion. His proof was that no cipher can provide perfect secrecy unless the key is at least a long as the message. Therefore, we know that no stream cipher can provide perfect secrecy unless it meets that requirement. But, just because it meets that requirement does not mean that it automatically provides perfect secrecy.

Now, as to whether or not they are the same, the answer is no. The one-time pad uses a fixed length key (where the length is at least a long as the message among other requirements) and the xor operation, period (i.e., there is no key expanion/stream generation).

-

Mathematically speaking. The entropy of a stream cipher is upper-bounded by the key size.

The entropy of a one time pad, on the other hand is upper-bounded by the plaintext size.

For true one-time pads and good stream ciphers, this bound is tight.

-
How is the term "entropy" defined for a cipher (i.e. an algorithm)? (I only know it as a measure of randomness for data, apart from the termodynamic meaning.) – Paŭlo Ebermann Jul 6 '13 at 21:06

the stream cipher is similar to the one-time pad but exact difference is that
one-time pad uses a genuine random number stream, whereas a stream cipher uses a pseudorandom number stream
pseudorandom numbers calculated by a computer through a deterministic process, cannot, by definition, be random. Given knowledge of the algorithm used to create the numbers and its internal state, you can predict all the numbers returned by subsequent calls to the algorithm,
whereas with genuinely random numbers, knowledge of one number or an arbitrarily long sequence of numbers is of no use whatsoever in predicting the next number to be generated.

-

More importantly a stream cipher can only produce a single plaintext regardless of what number of different keystreams you use. So even if you implemented a stream cipher machine with a true RNG and a non-stop stream of bits being fed into it, a brute force attack will still be possible because you just keep trying until you get something that makes sense.

A One-Time Pad can produce any plaintext of the same size as the ciphertext depending on what different keystreams you use. Meaning you can keep trying but get multiple things that make sense.

So unless you have the exact pad used to decode the message, you will never know which of the possible plaintexts you will stumble upon is the correct one or even if you have found the correct one yet.

That is perfect secrecy. When you can never even tell if you already cracked the message or not.

-
"a stream cipher can only produce a single plaintext", "a brute force attack will still be possible because you just keep trying until you get something that makes sense." Just No. Most of stream ciphers are implemented from symmetric crypto with CTR mode or hash-functions. And you will certainly get readable messages from a brute force attack, but you won't be able to know which one is the right one. – Biv Feb 24 at 15:28
So you are saying if I actually do create a machine using RC4 or AES-CTR and have a TRNG continually feed it a constant steady stream of random bits, it will meet the perfect secrecy requirement for a OTP? Provided that the stream of bits is purged after every message? – WAR10CK Feb 24 at 17:54
See : crypto.stackexchange.com/questions/33100 I will probably get down voted, but this is better in order to get an answer that might be even better than mine. :) – Biv Feb 24 at 18:47