# Maximum key stream sequence per key/IV pair in communication protocols

In the paper "LIZARD – A Lightweight Stream Cipher for Power-constrained Devices", one of the design rational of Lizard cipher is key stream size per key/iv pair.

A5/1 produces only 228 keystream bits per key/IV pair, where the session key is 64 bits long and the IV corresponds to 22 bits of the publicly known frame (i.e., packet) number. Similarly, Bluetooth packets contain at most 2790 bits for the so-called basic rate. The Bluetooth cipher E0 takes a 128-bit session key and uses 26 bits of the master’s clock, which is assumed to be publicly known, as the packet-specific IV. For wireless local area networks (WLANs), the currently active IEEE 802.11-2012 standard [Ins12] implies that at most 7943 bytes (i.e., < $$2^{16}$$ bits) are encrypted under the same key/IV pair using CCMP. Another widespread example for encryption on a per-packet basis is SSL/TLS, which underlies HTTPS and thus plays a vital role in securing the World Wide Web. In the most recent version, TLS 1.2 [DR08], the maximum amount of data encrypted under the same key/IV pair is $$2^{14}$$ + $$2^{10}$$ bytes (i.e., $$2^{17}$$ + $$2^{13}$$ < $$2^{18}$$ bits), as long as RC4, which is now forbidden for all TLS versions by RFC 7465 [Pop15], is not used.

My questions:

1. What are the conditions - such as cipher strength and packet size - used when calculating maximum key stream per key/IV?

2. How is the maximum key stream size calculated for the Zigbee protocol?