What is security of stream cipher against chosen plaintext attack?

Question

I have been looking for image encryption after compression using Ax+e, where A is a random matrix, x is plaintext and b is a bitstream generated using a stream cipher. Suppose choosing plaintext as all zeroes (dark image), will reveal many keystream bits. With the sufficiently large amount of known keystream bits, it is possible to obtain the original key. Is there any upper bound on the number of known keystream bits for a stream ciphers that can guarantee a sufficient resistance against attacks? For example, if the sequence has been generated by an LFSR of length n, then the Berlekamp-Massey algorithm is guaranteed to find this LFSR after examining no more than 2n bits of the sequence.

Is it possible to make above system cryptographically secure against chosen plaintext attack?

Is changing the initiation vector frequently so that attacker can get the limited amount of keystream bits only solution?

How to use initialization vector in such scenario?

Is one-time permutation after obtaining keystream bits proper solution?

Answer 1

Suppose choosing plaintext as all zeroes (dark image), will reveal many keystream bits.

It doesn't matter. When using proper cryptographic cipher the bits revealed should not tell anything about the key or previous / next bits.

With the sufficiently large amount of known keystream bits, it is possible to obtain the original key.

And this is where the term cryptographic comes to the game. The stream ciphers are designed to resist revealing its internal state so even possessing the complete amount of stream bits (used to encrypt the plaintext) it should be hard to derive the key and next bits.

Indeed the LFSR is very open to produce its internal state is not to be used as a stream cipher.

We already had a discussion on this forum. When using simple LFSR (such as common Random implementations with random seed) it is often enought to have very little of the ouput (in some cases 2 numbers) to reveal big part of the internal state and the rest is feasible to guess.

Is it possible to make above system cryptographically secure against chosen plaintext attack?

Just use proper cryptographic cipher () and you should be ok (assuming you use keys with high entropy and unique iv).

Is changing the initiation vector frequently so that attacker can get the limited amount of keystream bits only solution?
How to use initialization vector in such scenario?

You don't need to change IV often. E.g. Salsa has internal state of 512 bits (key size of 256 bits) so it is prettty much enough to encrypt all you need.

It is more important the IV is unique (or random/unpredictable if you want to play safe) for each key reuse. The stream cipher will take care of mixing IV into its output.

Is one-time permutation after obtaining keystream bits proper solution?

IMHO it is not necessary. When using simple permutations, it doesn't add any security (from the cryptographic point of view)