Would it be interesting to have new stream ciphers whose design is parametrized by a CSPRNG? I.e. to instantiate the stream cipher, you just have to select and plug in any CSPRNG of your choice.

  • 1
    $\begingroup$ What you describe sound more like a higher level construction than a stream cipher. Since xor is already perfect for what it does, your construction would need to offer other properties, such as authentication or nonce misuse resistance. There are such constructions, but nobody calls them stream ciphers. $\endgroup$ Nov 7, 2015 at 10:18
  • $\begingroup$ What are they called then, can you list several good/useful examples? $\endgroup$
    – daruma
    Nov 7, 2015 at 10:50
  • 1
    $\begingroup$ I'm not sure what the question is. A CSPRNG already "is" a stream cipher, just seed it with the key and XOR the output with the message. $\endgroup$
    – otus
    Nov 12, 2015 at 10:15
  • $\begingroup$ The security definitions for stream ciphers and CSPRNG are pretty much the same: The attacker should not be able to predict the next bit according to previous keystream he should not be able to guess the internal state, etc. The differentiation CSPRNG and stream cipher is mostly just a different point of view in the application/protocol/goal. Security-wise, they are the same. So your trivial answer is "no, it would not be interesting". $\endgroup$
    – tylo
    Nov 17, 2015 at 15:31

1 Answer 1


A stream cipher transforms a key and a nonce/IV into a stream of pseudorandom bits (a "keystream"). The keystream can be XOR'd with the plaintext to produce the ciphertext (encryption), or XOR'd with the ciphertext to produce the plaintext (decryption). So, stream ciphers generally define two operations, encryption and decryption (three if you count key generation).

CSPRNGs, however, are much more complex. They maintain an internal state, and define operations such as:

  • Set up: set up the internal state based on some secret seed value (i.e. an initial source of entropy)
  • Reseed: mix new entropy into the generator's internal state
  • Generate output: use the internal state to produce some number of pseudorandom bits, then update the internal state (so that the next output is unrelated to this one)

Now, your question:

Would it be interesting to have new stream ciphers whose design is parametrized by a CSPRNG?

I think it would be interesting. I'm not sure that it would be particularly practical.

CSPRNGs are designed for a very different purpose, and their implementation reflects that. Features like backtracking resistance and reseeding are just not relevant to a stream cipher. Stream ciphers are typically stateless, while CSPRNGs maintain an internal state. Etc. It's possible to create a stream cipher from a CSPRNG, but it really overcomplicates the design.

CSPRNGs and stream ciphers do have something in common, however: they both expand a small source of entropy into a stream of pseudorandom bits. This is likely the source of your question. Indeed, there is significant cross-pollination of ideas between stream ciphers and CSPRNGs due to this similarity:

  • CTR_DRBG is a CSPRNG that uses a block cipher (e.g. AES) in counter mode, much like how a block cipher in counter mode can be used to construct a stream cipher.
  • libsodium includes a CSPRNG based on Salsa20, one of the winners of the eSTREAM stream cipher competition.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.