1
$\begingroup$

What are the benefits and drawbacks of each?

$\endgroup$
1
  • $\begingroup$ Welcome to Cryptography. What is the origin of this question? What did you research up to now? Did you read the Wikipedia page? What is not clear there? $\endgroup$ – kelalaka Mar 23 at 20:08
2
$\begingroup$

With synchronous stream ciphers, the bits of the key stream do not depend on the ciphertext bits. With asynchronous stream ciphers the key stream can be inferred (provided one knows the secret key) from previous bits of the cipher stream. If you're familiar with block cipher modes CTR would be an example of a synchronous streaming mode and CFB would be an example of an asynchronous mode.

Synchronous ciphers have the advantage that key stream can be pre-computed before plaintext or ciphertext is provided, often with parallelism. They have the disadvantage of ciphertext malleability (a known change in ciphertext produces a known change in plaintext) and so will need to be combined with some form of message authentication. If a transmission is only received in part, in can be difficult to recover the fragment as the exact position in the key stream needs to be identified (synchronisation). Synchronous ciphers are also deterministic constructions with a finite number of possible states and so will eventually cycle. Care must be taken in their construction/initialisation to make sure that short cycles are unlikely. For most stream ciphers (e.g. those combining key and plaintext by XOR) chosen ciphertext is equivalent to chosen plaintext in the information provided about the cipher which simplifies the security modelling. With no ciphertext dependency two different plaintexts encrypted with the same key are added to the same keystream which leads to significant weakness.

Asynchronous ciphers are largely serial in the encryption process (though not necessarily the decryption process) and the key stream can only be computed once the plaintext/ciphertext is provided. However, changing the ciphertext changes subsequent key stream and so there is considerably less malleability and a degree of message authentication. They also allow easy synchronisation at any point in transmission as the receiver can infer key stream after an initial run up of cipher bits (self-synchronisation). Asynchronous ciphers can always be provided with plaintext that prevents cycling and so no special cycle analysis is required. However chosen ciphertext has an effect on keystream and so CPA and CCA must be considered separately. Distinct plaintexts will lead to distinct keystreams, reducing the danger of repeated keys.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.