Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

E. g. block ciphers have GCM or OCB, that take single cryptographic primitive (block cipher) and provide both authentication and encryption.

Are there similar constructs for stream ciphers, which provide both authentication and encryption using only one cryptographic primitive - actual stream cipher (or keystream)?

share|improve this question

An OCB like mode seems impossible with stream-ciphers. It's coupled tightly to the concept of a keyed permutation i.e. a (tweakable) block-cipher.

Many authenticated encryption actually combine two distinct primitives. It's just that the specification and API only expose the combination.

Essentially these xor a key-stream into the message to encrypt it (i.e. they use a synchronous stream cipher), and then authenticate the ciphertext using a MAC. Often they use part of the key-stream as one-time keys for the MAC.

  • AES-GCM is built by combining a polynomial one-time MAC called GHash with the stream cipher AES-CTR.

    While AES itself is a block cipher, AES-CTR behaves like a stream cipher. GCM doesn't use AES in a way that'd prevent the use of a stream cipher.

  • Salsa20-Poly1305 is built by combining a polynomial one-time MAC called Poly1305 with the stream cipher Salsa.
  • Poly1305-AES is built by combining a polynomial one-time MAC called Poly1305 with the stream cipher AES-CTR.

Then there are some stream ciphers which provide authentication without a separate primitive. These constructions aren't synchronous stream ciphers, and can't be used together with a one-time-pad or plain key-stream.

  • Helix and Phelix are authenticated stream ciphers that merge authentication and encryption. There has been some criticism of their security, but I'm not sure if that criticism is actually valid.
  • Keccak (built on an unkeyed permutation) using the duplex constructio can considered an authenticated stream cipher
share|improve this answer
Poly1305-AES is Poly1305 with an AES block encrypt of a nonce with a long-term key to provide the one time key. It looks like you could use an AES-CTR + Poly1305 construction, but that's something different. – archie Aug 2 '13 at 18:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.