Are all stream ciphers algorithms based XOR with the key?
Almost all. The reason is simple; x-or is a cheap operation and $c = m \oplus k$ then
$$c \oplus k = (m\oplus k) \oplus k = m$$
Therefore if you x-or the message with the keystream then re-xor is equal to the message. This helps to use the same logic as encryption and decryption. This reduces the cost of hardware.
There is another important property of the x-or;
- x-or of a random sequence with a non-random sequence is random. Therefore it can hide our non-random messages very well if the produced sequence for the stream cipher has good randomness.
Note that a stream cipher doesn't need to output one bit per cycle/encryption. AES in CTR mode is a stream cipher that produces 128-bit per AES encryption/counter. The ChaCha20 stream cipher has a 64-byte block size, in other words, it produces 512 bits per counter.
As pointed FGrieu, there is also modular addition/substruction, when the number of the symbols are not power of 2, $c = m + k \bmod n$ for encryption and $m = c - k \bmod n$ is used. The Solitaire manual stream cipher uses this operation.
What happens when the key length is less than the size of the message?
Stream ciphers are designed to produce a very long sequence of bits, so there is no issue here. The real issue is reusing a (key,nonce) pair more than one. This can result in the loss of confidentiality.
Does all algorithms perform the same XOR operation with the key or there are other operations to be performed as is the case with block cipher where multiple rounds and derivate keys are used?
Well, the obvious answer is the x-nor, that is $\neg\oplus$. Can we use other than x-or and x-nor? Exercise:
- find a binary operation that doesn't destroy information yet doesn't leak, too!
How can I better understand the stream cipher?
Well, reading a book about stream ciphers and designs? You can start from