A stream cipher is an encryption algorithm which encrypts arbitrary length plain text, using a (fixed length) key. Some stream ciphers generate a key stream from only the key, which is then XOR-combined with the plain text, others feed back plain text or cryptotext into the algorithm to create the ...

learn more… | top users | synonyms

59
votes
11answers
5k views

Is modern encryption needlessly complicated?

RSA, DES, AES, etc. all use (relatively) complicated mathematics to encrypt some message with some key. For each of these methods, there have been several documented vulnerabilities found over the ...
18
votes
4answers
1k views

With sufficient randomness, is XOR an acceptable mechanism for encrypting?

I have heard criticism of various cryptosystems saying that "at their heart, they were just XOR." Is this just ignorance, or is there something inherently wrong with XOR based ciphers?
11
votes
2answers
280 views

Can I use HMAC-SHA1 in counter mode to make a stream cipher?

Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey). Would it be secure to feed it like a block cipher in counter mode to get a ...
11
votes
4answers
837 views

Can you make a hash out of a stream cipher?

A comment on another question made me wonder about something: Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
9
votes
2answers
7k views

Many time pad attack [duplicate]

I've already sent my correct solution to a homework exercise from Dan Boneh's Introduction to Cryptography class on Coursera: "Let us see what goes wrong when a stream cipher key is used more than ...
9
votes
4answers
2k views

What is the difference between a stream cipher and a one-time-pad?

A (synchronous) stream cipher is an algorithm which maps some fixed-length key to an arbitrary-length key-stream (i.e. a sequence of bits): $C : \{0,1\}^k \to \{0,1\}^{\infty}$. This key-stream is ...
8
votes
2answers
456 views

Are Stream Ciphers Less Secure?

This is by no means a scientific observation, but it seems to me that stream ciphers receive a lot less attention than block ciphers. Is there any reason for this? (Is it because block ciphers are ...
8
votes
2answers
529 views

What are the methods to construct a primitive binary nonlinear feedback shift register (NLFSR)?

Given a binary shift register of $n$ bits, a primitive binary nonlinear feedback shift register will generate a sequence with a period of $2^n - 1$. While I am unable to find a paper which directly ...
7
votes
4answers
1k views

Is it feasible to build a stream cipher from a cryptographic hash function?

A few years ago I devised a symmetric-key system that worked like so: ...
7
votes
3answers
13k views

Difference between stream cipher and block cipher

A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time. A block cipher ...
7
votes
3answers
674 views

Converting a stream cipher into a block cipher

The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ...
7
votes
2answers
282 views

Streaming API to authenticated encryption

In regards to NaCl, I asked DJB he had any intent to add a streaming API to an authenticated cipher. His response was obvious in retrospect, that one should never release a decrypted plaintext before ...
7
votes
1answer
156 views

Specification of the scream stream cipher is unclear

I am implementing in C++ the Scream stream cipher. The Scream family is composed of Scream-0, Scream-S and Scream-F. For this question, assume that I'm using Scream-S. The specifications of the ...
6
votes
3answers
653 views

Can I safely replace XOR with ADD in a stream cipher?

In a stream cipher, the bytes of the plaintext are usually XORed with the keystream to produce the ciphertext. Would there be anything wrong with adding the bytes instead (with overflow), if adding ...
6
votes
3answers
297 views

Word-based stream ciphers vs “regular” stream ciphers?

Could somebody explain what is the difference between "word-based" stream ciphers and the regular ones? Those last ones use pseudo-random sequences XOR'd bit by bit with the message, as far as I know. ...
6
votes
1answer
311 views

Are stream ciphers no longer considered by NIST?

While reading NIST SP 800-90A, "Recommendation for Random Number Generation Using Deterministic Random Bit Generators", I noted that no stream cipher was included among the various specified ...
5
votes
3answers
657 views

CBC - a canonical mode, even though there are streaming modes

Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you ...
5
votes
3answers
793 views

What is the PRG period of stream ciphers such as RC4 or Salsa20?

I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example. Let's say I want to encrypt a very ...
5
votes
2answers
303 views

Reusing AES-CTR Keys and IVs for File Encryption

I’m implementing some file encryption module with random-access capability and AES-CTR seems the right way to go. I understand that reusing Keys and IVs can expose the file to ‘Stream Cipher Attacks’ ...
5
votes
1answer
157 views

Determine LFSR phase quickly?

I know it's possible with work backwards from the output bits of an LFSR to determine its feedback polynomial in a O(n) fashion. I'm also curious if, given an LFSR state and polynomial, is it ...
5
votes
1answer
340 views

Authenticated encryption mode for stream cipher?

E. g. block ciphers have GCM or OCB, that take single cryptographic primitive (block cipher) and provide both authentication and encryption. Are there similar constructs for stream ciphers, which ...
5
votes
1answer
139 views

Proof that Alternating Step Generator and modifed ASG' have equivalent security?

The Alternating Step Generator (ASG) is a PRNG combining 3 LFSRs. Output of the ASG is the XOR of the output of two clock-gated LFSRs. At each step, a single one of these LFSRs is clocked, according ...
5
votes
1answer
104 views

Security analysis of Spritz?

Recently, a new cipher called Spritz has been released by Ronald L. Rivest and Jacob Schuldt. It should be a "drop-in replacement" for RC4. There are many differences to RC4, Spritz is "spongy" and ...
5
votes
0answers
421 views

How can I find two strings $m_1$ and $m_2$, knowing that I know $m_1 \oplus m_2$? [duplicate]

Possible Duplicate: How does one attack a two-time pad (i.e. one time pad with key reuse)? I recently started to follow the cryptography class of Dan Boneh on coursera.org and the first ...
4
votes
4answers
528 views

Why isn't the alternating step generator used more often?

According to the Wikipedia entry for the Alternating Step pseudorandom number generator, there is no public cryptanalysis for this device since it was invented back in 1987 by C.G. Gunther. I have ...
4
votes
2answers
129 views

Is a simple stream cipher “partially homomorphic” if no integrity check is applied?

My understanding is that, simply put, a stream cipher is just a CSPRNG such that $R(i,k)$ will produce a deterministic but statistically random sequence, where $i$ is an IV, and $k$ is the session ...
4
votes
2answers
368 views

Is any decent RNG acceptable as a stream cipher?

I have a function f(x,n) that takes a 128-bit key x, and generates n bytes of pseudo-random data. I've tested the output bytes this function for various keys with the NIST RNG testing suite (NIST ...
4
votes
2answers
1k views

Which stream cipher can we replace the RC4 in the SSL?

In cryptography, the Fluhrer, Mantin and Shamir attack is a particular stream cipher attack, a dedicated form of cryptanalysis for attacking the widely-used stream cipher RC4. The attack allows an ...
4
votes
1answer
358 views

How secure is my OTP program?

I'm writing an One-Time Pad encryption program, because I got really interested in the idea of " encryption which has been proven to be impossible to crack if used correctly". I'm writing the program ...
4
votes
1answer
173 views

When is an asymmetric scheme considered broken?

Does the following quote imply that valid encrypted data can be created and decrypted by someone other than the owner of a private key: An asymmetric encryption scheme is considered to be broken ...
4
votes
4answers
814 views

Stretching a random seed to maximize entropy

I'm using a random number generator that requires me to pass it a big (several kilobytes) pool of random data for initialization. I've gathered entropy from various system metrics (free memory, ...
4
votes
1answer
190 views

hardware and software optimizations for Salsa20

I'm using the Crypto++ implementation of Salsa20 for a software project we are working on and I'd like to know if there are any SSE or software optimizations that will increase the speed of the CSPNG? ...
4
votes
1answer
809 views

Fast Salsa20 in java?

For Java I'm only aware of the Bouncy Castle implementation of Salsa20. However, that version is significantly slower than AES-CTR and ARC4. There are plenty of libraries in C, but are there any good ...
4
votes
2answers
87 views

Advantages of making streamcipher stream depend on plaintext?

Most descriptions that explain how streamciphers work (like the one on Wikipedia), tend to describe a model that boils down to a simple “$ciphertext = plaintext \oplus stream$”, where the stream is ...
4
votes
1answer
183 views

Is it safe to assume Salsa20 to be a PRP?

Often in security proofs a certain block cipher is assumed to be a pseudorandom permutation or PRP. I wonder if this goes for stream ciphers as well, and specifically for Salsa20. If limit ourselves ...
4
votes
1answer
261 views

LFSR dynamic mutation

In normal LFSR, the state is a function of the initial seed, taps positions and time, nothing else. I've seen a modification of LFSR that works like this: ...
4
votes
2answers
171 views

Stream cipher with Diffie-Hellman and Cryptographic Hash Function?

(Already asked the same question on stackoverflow but I was told to better ask here. http://stackoverflow.com/questions/17527192/one-time-pad-with-dh-and-cryptographic-hash-function) I know: Never do ...
3
votes
4answers
353 views

Is there a way to generate sound one-time pads out of public information?

Is there a way to 'mangle' a public data-source (for example, the current date in YYYYMMDD or the top New York Times headline) to form a one-time pad that will sufficiently hide the pad's source? ...
3
votes
2answers
306 views

Number of states in a LFSR

Do all $2^{\ell}$ (where $\ell$ is the bit length of the shift register) states always occur in a LFSR or can I choose my taps badly so some states are skipped and the period is shortened? If so is ...
3
votes
2answers
456 views

Theoretical pi-based stream cipher

Let's pretend that all digits of pi are known and arbitrarily long sequences of digits are trivial to get. Further, some mathematician proves that there are no patterns in pi. We could create a stream ...
3
votes
2answers
161 views

Can you really insert the text you want in one-time pad?

The Wikipedia article "One-time pad ~ Authentication" says : For example, an attacker who knows that the message contains "meet jane and me tomorrow at three thirty pm" at a particular point can ...
3
votes
1answer
203 views

Using same AES-GCM setup for multiple packets?

Most cryptographic libraries I've encountered uses some variant of processPlaintext(...) and then doFinal() to produce the ...
3
votes
1answer
171 views

Non-cryptographic hash function as MAC for stream ciphers

I understand that for a stream cipher to be useful, there must be a way to verify that the message was not tampered with (bits were flipped by an attacker). So, instead of using some cryptographic ...
3
votes
1answer
99 views

Is the following scheme secure for different cipher

Let's say I have two keys K1 and K2. two messages M1 and M2 of the same length. Cipher (E,D) 3 ciphertexts: C11, C12,C22 where Cij = E(Ki, Mj) In situation ...
3
votes
2answers
269 views

Definition of a CSPRNG

I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG). Wikipedia lists two defining characteristics: It ...
3
votes
1answer
371 views

Are there secure stream ciphers that cannot be parallelized?

Are there any stream ciphers (or a deterministic random number generators, that should work as well I guess?) that cannot be parallelized? So for example if I seed it with a specific value, and then ...
3
votes
2answers
512 views

are CFB and OFB really meant for streaming?

CFB, OFB and other modes are meant for streaming and don't require padding. Are there still limitations such as the text needs to be greater than key length?
3
votes
1answer
448 views

Perfect Secrecy -> One Time Semantic Security -> Secure PRG

I think I have some sense of what Perfect Security means, and even Semantic Security, but I am struggling with randomness, so I'm going to ask a question about CSPRG's (Cryptographically Secure PRG's) ...
3
votes
1answer
202 views

Stream ciphers based on discrete logs

Blum Blum Shub is a stream cipher that is provably reducible to the difficulty of factoring integers. I'm wondering whether there is a similar construction for discrete logs? For example, I could ...
3
votes
3answers
261 views

Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?

Consider a communication channel that needs to be secure (Encryption can not use full "volume" encryption, since future messages are not known). Would it be better to only transmit encrypted ...