A stream cipher is an encryption algorithm which encrypts arbitrary length plaintext, using a key. Some stream ciphers generate a keystream from only the key, which is then XOR-combined with the plain text, others feed back plaintext or ciphertext into the algorithm to create the keystream.

learn more… | top users | synonyms

67
votes
11answers
6k views

Is modern encryption needlessly complicated?

RSA, DES, AES, etc. all use (relatively) complicated mathematics to encrypt some message with some key. For each of these methods, there have been several documented vulnerabilities found over the ...
20
votes
3answers
41k views

Difference between stream cipher and block cipher

A typical stream cipher encrypts plaintext one byte at a time, although a stream cipher may be designed to operate on one bit at a time or on units larger than a byte at a time. A block cipher ...
19
votes
4answers
2k views

With sufficient randomness, is XOR an acceptable mechanism for encrypting?

I have heard criticism of various cryptosystems saying that "at their heart, they were just XOR." Is this just ignorance, or is there something inherently wrong with XOR based ciphers?
15
votes
6answers
4k views

What is the difference between a stream cipher and a one-time-pad?

A (synchronous) stream cipher is an algorithm which maps some fixed-length key to an arbitrary-length key-stream (i.e. a sequence of bits): $C : \{0,1\}^k \to \{0,1\}^{\infty}$. This key-stream is ...
13
votes
1answer
16k views

Many time pad attack [duplicate]

I've already sent my correct solution to a homework exercise from Dan Boneh's Introduction to Cryptography class on Coursera: "Let us see what goes wrong when a stream cipher key is used more than ...
13
votes
5answers
1k views

Can you make a hash out of a stream cipher?

A comment on another question made me wonder about something: Assume you're on a rather constrained platform — say, a low-end embedded device — with no built-in crypto capabilities, ...
12
votes
4answers
2k views

Is it feasible to build a stream cipher from a cryptographic hash function?

A few years ago I devised a symmetric-key system that worked like so: ...
12
votes
2answers
649 views

Can I use HMAC-SHA1 in counter mode to make a stream cipher?

Say I have an embedded device which is only capable of doing HMAC-SHA1 transformations (that device is, in fact, a YubiKey). Would it be secure to feed it like a block cipher in counter mode to get a ...
10
votes
3answers
1k views

Converting a stream cipher into a block cipher

The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher. Is there a way to do the reverse? In other words, given a "good" ...
9
votes
1answer
615 views

Why do stream ciphers use a nonce?

My question maybe will be stupid, but my problem is that I do not understand why stream ciphers need a key and also a nonce. As far as I understand, the keystream is generated with the nonce. The same ...
9
votes
2answers
473 views

Streaming API to authenticated encryption

In regards to NaCl, I asked DJB he had any intent to add a streaming API to an authenticated cipher. His response was obvious in retrospect, that one should never release a decrypted plaintext before ...
9
votes
1answer
761 views

What are the methods to construct a primitive binary nonlinear feedback shift register (NLFSR)?

Given a binary shift register of $n$ bits, a primitive binary nonlinear feedback shift register will generate a sequence with a period of $2^n - 1$. While I am unable to find a paper which directly ...
8
votes
3answers
1k views

What is the PRG period of stream ciphers such as RC4 or Salsa20?

I am confused about how long a stream cipher can be used before you should change the key. To be concrete, let me use the stream cipher based on RC4 as an example. Let's say I want to encrypt a very ...
8
votes
2answers
573 views

Are Stream Ciphers Less Secure?

This is by no means a scientific observation, but it seems to me that stream ciphers receive a lot less attention than block ciphers. Is there any reason for this? (Is it because block ciphers are ...
8
votes
2answers
4k views

AES GCM vs other encryption modes in embedded environment for network traffic

I'm doing a lot of research since I'm doing an internship for a company where I need to upgrade their security level. Their own protocol needs a cryptographic upgrade and I'm leaning towards AES since ...
8
votes
1answer
556 views

Are stream ciphers no longer considered by NIST?

While reading NIST SP 800-90A, "Recommendation for Random Number Generation Using Deterministic Random Bit Generators", I noted that no stream cipher was included among the various specified solutions....
7
votes
3answers
1k views

Can I safely replace XOR with ADD in a stream cipher?

In a stream cipher, the bytes of the plaintext are usually XORed with the keystream to produce the ciphertext. Would there be anything wrong with adding the bytes instead (with overflow), if adding ...
7
votes
3answers
905 views

CBC - a canonical mode, even though there are streaming modes

Why is CBC considered the canonical mode when there are streaming modes available such as CFB and OFB? One thing that I can think of is that in CBC you can easliy do range-based decryption. All you ...
7
votes
4answers
1k views

Theoretical pi-based stream cipher

Let's pretend that all digits of pi are known and arbitrarily long sequences of digits are trivial to get. Further, some mathematician proves that there are no patterns in pi. We could create a stream ...
7
votes
2answers
369 views

What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

I can precompute the key stream for the CTR mode operation and the encryption at that point is similar to a stream cipher. So why are there stream ciphers still used and proposed after RC4? Recently ...
7
votes
1answer
580 views

Dancing confusion with Daniel J. Bernstein's stream ciphers

I know of Salsa20 which won the ESTREAM competition. This is dated of 25 Dec 2007. There is also the ChaCha20 stream cipher (cr.yp.to/chacha.html). This claims to increase the amount of diffusion ...
7
votes
2answers
550 views

Definition of a CSPRNG

I am interested in what conditions are necessary and sufficient to define a cryptographically secure pseudo-random number generator (CSPRNG). Wikipedia lists two defining characteristics: It ...
7
votes
1answer
190 views

Specification of the scream stream cipher is unclear

I am implementing in C++ the Scream stream cipher. The Scream family is composed of Scream-0, Scream-S and Scream-F. For this question, assume that I'm using Scream-S. The specifications of the ...
6
votes
1answer
571 views

What do you call one time pad where pseudo-random numbers are used?

What is the encryption method called when pseudo-random numbers are used instead of true random numbers?
6
votes
3answers
428 views

Word-based stream ciphers vs “regular” stream ciphers?

Could somebody explain what is the difference between "word-based" stream ciphers and the regular ones? Those last ones use pseudo-random sequences XOR'd bit by bit with the message, as far as I know. ...
6
votes
2answers
455 views

Determine LFSR phase quickly?

I know it's possible with work backwards from the output bits of an LFSR to determine its feedback polynomial in a O(n) fashion. I'm also curious if, given an LFSR state and polynomial, is it ...
6
votes
2answers
171 views

Advantages of making streamcipher stream depend on plaintext?

Most descriptions that explain how streamciphers work (like the one on Wikipedia), tend to describe a model that boils down to a simple “$ciphertext = plaintext \oplus stream$”, where the stream is ...
6
votes
1answer
70 views

How distinct are the meanings of the terms “CSPRNG,” “DRBG” and “stream cipher”?

Are there universal, consensus definitions for the following terms? Cryptographically secure pseudo-random number generator ("CSPRNG") Deterministic random bit generator ("DRBG") Stream cipher ...
6
votes
2answers
95 views

Possible problems in using a hash algorithm to construct a stream cipher

I'll define an example hash-based stream cipher as such: $H: \{0,1\}^* \rightarrow \{0,1\}^{256}$ is the hash function. $K=\{0,1\}^{256}$ is the secret key. $N=\{0,1\}^{128}$ is the nonce. $C=\{0,1\}...
6
votes
1answer
132 views

Streaming mode of operation that is more resistant against nonce reuse

Is it possible to create a streaming mode of operation where the reuse of a nonce does not destroy confidentiality? In this question it would be allowed for the streaming mode to leak if ciphertexts ...
6
votes
2answers
82 views

How to propagate error in variable-sized message?

I want to design a scheme to encrypt a variable-length message with a secret key, to provide confidentiality. The message is a short human-readable text string with byte granularity, let's say under ...
5
votes
2answers
1k views

Combining LFSRs for Stream Ciphers: Why do we need high non-linearity?

Linear Feedback Shift Registers (LFSRs) can be excellent (efficient, fast, and with good statistial properties) pseudo-random generators. Many stream ciphers are based on LFSRs and one of the possible ...
5
votes
4answers
1k views

Stretching a random seed to maximize entropy

I'm using a random number generator that requires me to pass it a big (several kilobytes) pool of random data for initialization. I've gathered entropy from various system metrics (free memory, ...
5
votes
1answer
482 views

Dan Boneh's Cryptography lecture - problem with 802.11b

I am going through Dan Boneh's Cyprography lectures on Coursera. In Lecture 6 https://class.coursera.org/crypto-010/lecture/6 At 7:30 minutes, he discusses the problems with 802.11b design. I ...
5
votes
2answers
243 views

What happens when a RC4 stream gets corrupted?

I want to encrypt a large file using RC4. But what happens if the encrypted file gets corrupted (bytes modified or lost)? Can I still decrypt the rest of the file correctly? If not, what is the best ...
5
votes
1answer
595 views

Security considerations on “expand 32-byte k”-magic number in the Salsa20 famility of stream ciphers?

I'm currently examining the NaCl library written by Daniel J. Bernstein and I noticed that the library hard codes the sigma: ...
5
votes
1answer
4k views

How much is slower GCM AES-128 than one of the stream chipher eSTREAM?

Evaluate the speed of the algorithm GCM AES-128 and compare it whith speed of one of the stream chipher in eSTREAM. Can someone give such an assessment?
5
votes
2answers
5k views

Which stream cipher can we replace the RC4 in the SSL?

In cryptography, the Fluhrer, Mantin and Shamir attack is a particular stream cipher attack, a dedicated form of cryptanalysis for attacking the widely-used stream cipher RC4. The attack allows an ...
5
votes
2answers
592 views

Reusing AES-CTR Keys and IVs for File Encryption

I’m implementing some file encryption module with random-access capability and AES-CTR seems the right way to go. I understand that reusing Keys and IVs can expose the file to ‘Stream Cipher Attacks’ ...
5
votes
1answer
2k views

Fast Salsa20 in java?

For Java I'm only aware of the Bouncy Castle implementation of Salsa20. However, that version is significantly slower than AES-CTR and ARC4. There are plenty of libraries in C, but are there any good ...
5
votes
1answer
336 views

hardware and software optimizations for Salsa20

I'm using the Crypto++ implementation of Salsa20 for a software project we are working on and I'd like to know if there are any SSE or software optimizations that will increase the speed of the CSPNG?
5
votes
2answers
900 views

are CFB and OFB really meant for streaming?

CFB, OFB and other modes are meant for streaming and don't require padding. Are there still limitations such as the text needs to be greater than key length?
5
votes
3answers
324 views

Is a continuous stream of encrypted data embedded in garbage more or less secure than only encrypting the data?

Consider a communication channel that needs to be secure (Encryption can not use full "volume" encryption, since future messages are not known). Would it be better to only transmit encrypted ...
5
votes
1answer
834 views

Authenticated encryption mode for stream cipher?

E. g. block ciphers have GCM or OCB, that take single cryptographic primitive (block cipher) and provide both authentication and encryption. Are there similar constructs for stream ciphers, which ...
5
votes
1answer
166 views

Proof that Alternating Step Generator and modifed ASG' have equivalent security?

The Alternating Step Generator (ASG) is a PRNG combining 3 LFSRs. Output of the ASG is the XOR of the output of two clock-gated LFSRs. At each step, a single one of these LFSRs is clocked, according ...
5
votes
1answer
146 views

Can somebody help me understand RC4 Spritz? (Three Questions)

So ever since I first took a stab at understanding stream Ciphers, not one stood out more than RC4, because it's so fantastically simple. As most people reading this will know, with its fantastic ...
5
votes
1answer
831 views

Security analysis of Spritz?

Recently, a new cipher called Spritz has been released by Ronald L. Rivest and Jacob Schuldt. It should be a "drop-in replacement" for RC4. There are many differences to RC4, Spritz is "spongy" and ...
5
votes
0answers
456 views

How can I find two strings $m_1$ and $m_2$, knowing that I know $m_1 \oplus m_2$? [duplicate]

Possible Duplicate: How does one attack a two-time pad (i.e. one time pad with key reuse)? I recently started to follow the cryptography class of Dan Boneh on coursera.org and the first part ...
4
votes
4answers
724 views

Why isn't the alternating step generator used more often?

According to the Wikipedia entry for the Alternating Step pseudorandom number generator, there is no public cryptanalysis for this device since it was invented back in 1987 by C.G. Gunther. I have ...
4
votes
4answers
569 views

Is there a way to generate sound one-time pads out of public information?

Is there a way to 'mangle' a public data-source (for example, the current date in YYYYMMDD or the top New York Times headline) to form a one-time pad that will sufficiently hide the pad's source? ...