# How can I create a stream cipher from a block cipher?

Assuming $k$ is the key (128 bit) and $m$ is the message (128 bit), how can I use the block cipher $blockenc(k,m)$ to make a stream cipher which can produce quintillion pseudo-random bits?

• "Counter Mode". – SEJPM Jun 24 '18 at 17:23
• i presume the counter would increment to the number of expected bits that we want to be produced as part of the process? – PVGupta Jun 25 '18 at 11:55

Assuming k is the key (128 bit) and m is the message (128 bit), how can I use the block cipher blockenc(k,m) to make a stream cipher…

Probably the easiest way to achieve that would be to use Counter Mode (CTR) as a block cipher mode of operation where the counter increases by some value, which can be but does not have to be +1. So, to also address your comment: you could indeed increment by the number of bytes or bits you’re encrypting.

If you want to dive into CTR mode a bit more, be sure to also look at our CTR tag which lists related Q&As.

... which can produce quintillion pseudo-random bits?

It has to be noted that that will depend on the block cipher you’re using – more specifically: the block cipher security bounds. Weak block ciphers and/or block ciphers from the "lightweight crypto" category might, in some cases, reach their limits before that.

Practically, I’ll simply point to AES in CTR mode as a well-vetted and somewhat standard choice (as used, for example, in RFC 3686 – Using Advanced Encryption Standard (AES) Counter Mode With IPsec Encapsulating Security Payload (ESP)).

There are 3 modes of operation which make a stream cipher out of a block cipher:

1. Cipher Feedback Mode,
2. Output Feedback Mode, and
3. Counter Mode.

Taking example of the Counter Mode, this is how encryption and decryption works

$$C_i = P_i \oplus BlockEnc_k(count)\\ P_i = C_i \oplus BlockEnc_k(count)$$ $count$ is increased by 1 with every byte of the stream.

• What about GCM, CCM, OCB, etc? I mean granted the first two are based on CTR internally, but still. – forest Jun 25 '18 at 3:04
• The counter increments on each round? and sort of acts like a IV. The counter would therefore allow the processing of the how many bits we require as part of the stream. – PVGupta Jun 25 '18 at 11:56
• Yes, counter is incremented with every incoming byte. Streams will not be very large that the counter overflows its assigned bitsize, however if streams are large, then key can be changed at some point and then counter can again start from the beginning. – Mayank Jun 25 '18 at 12:53