The diffusion property of a cipher defined by Shannon refers to the ability of a cipher to cause a lot off bits in the cipher text to be modified, when even a single bit in the plaintext is flips.

However, in stream ciphers – when the cipher text is the xor of the plaintext with the key pattern – a flip in the plaintext will always cause exactly one bit modification in the cipher text.

Does this mean that stream ciphers have a low level of diffusion?


1 Answer 1


Stream ciphers in general are more efficient but less secure than a block cipher, provided all else being equal in terms of each construction following both necessary and preferred principles (Katz & Lindell, 2009; Boneh, 2013).

Shannon's “confusion and diffusion” refers to good confusion and diffusion of message block bits and secrecy bits based upon linear and non-linear functions as you mostly point out.

There are different kinds of stream ciphers as there are different block ciphers. Some stream ciphers did not pass two or more critical statistical tests to show powerful diffusion.

In general you are correct: stream ciphers either have low or even slow diffusion rates. However, linear masking and improve initialization processes helps reduce vulnerability to linear and side attacks. Stream cipher Hc-256 is a good candidate to test further.

Stream ciphers are faster than block ciphers, but block ciphers with proper construction have higher diffusion – still, pseudo-randomness can be generated from a block cipher to stream ciphers to reduce attack vulnerabilities.

Additional reading:

Same author as thesis but shorter and more straightforward:

  • 1
    $\begingroup$ The idea that stream ciphers are more efficient but less secure is seriously outdated. $\endgroup$
    – forest
    Commented Jan 6, 2020 at 7:33
  • $\begingroup$ Not really true; I am open to citations though. $\endgroup$ Commented Sep 9, 2023 at 13:42
  • 1
    $\begingroup$ Stream ciphers are not less secure just because they are vulnerable to keystream reuse any more than block ciphers are less secure because they lack IND-CPA security in ECB mode. $\endgroup$
    – forest
    Commented Sep 10, 2023 at 1:03
  • $\begingroup$ Block ciphers overall are still more secure due to the combination of data confusion and diffusion whereas stream ciphers only apply the confusion approach. Block ciphers obtain authenticated encryption. $\endgroup$ Commented Sep 14, 2023 at 20:37
  • 2
    $\begingroup$ That is completely and utterly incorrect. Both "true" stream ciphers and block ciphers turned into stream ciphers with a mode of operation like CTR utilize confusion and diffusion. Furthermore, block ciphers do not provide authenticated encryption on their own, nor do stream ciphers. You have to provide authentication yourself, and precious few ciphers come with it built-in (I can only think of AEZ and a few Keccak permutation-based ciphers off the top of my head). For all other ciphers, you need to use authentication like GCM (for block ciphers) or Poly1305 (for stream ciphers). $\endgroup$
    – forest
    Commented Sep 15, 2023 at 5:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.