Block ciphers have modes like GCM or OCB that combine primitives to provide both authentication and encryption.

Are there similar constructs for stream ciphers, which provide both authentication and encryption using only one cryptographic primitive - actual stream cipher (or keystream)?


2 Answers 2


An OCB like mode seems impossible with stream-ciphers. It's coupled tightly to the concept of a keyed permutation i.e. a (tweakable) block-cipher.

Many authenticated encryption actually combine two distinct primitives. It's just that the specification and API only expose the combination.

Essentially these xor a key-stream into the message to encrypt it (i.e. they use a synchronous stream cipher), and then authenticate the ciphertext using a MAC. Often they use part of the key-stream as one-time keys for the MAC.

  • AES-GCM is built by combining a polynomial one-time MAC called GHash with the stream cipher AES-CTR.

    While AES itself is a block cipher, AES-CTR behaves like a stream cipher. GCM doesn't use AES in a way that'd prevent the use of a stream cipher.

  • Salsa20-Poly1305 is built by combining a polynomial one-time MAC called Poly1305 with the stream cipher Salsa.
  • Poly1305-AES is built by combining a polynomial one-time MAC called Poly1305 with the stream cipher AES-CTR.

Then there are some stream ciphers which provide authentication without a separate primitive. These constructions aren't synchronous stream ciphers, and can't be used together with a one-time-pad or plain key-stream.

  • Helix and Phelix are authenticated stream ciphers that merge authentication and encryption. There has been some criticism of their security, but I'm not sure if that criticism is actually valid.
  • Keccak (built on an unkeyed permutation) using the duplex constructio can considered an authenticated stream cipher
  • 1
    $\begingroup$ Poly1305-AES is Poly1305 with an AES block encrypt of a nonce with a long-term key to provide the one time key. It looks like you could use an AES-CTR + Poly1305 construction, but that's something different. $\endgroup$
    – archie
    Aug 2, 2013 at 18:35

extending to the top answer

ACORN (lightweight authenticated cipher) is a stream-based AE scheme and is one of the finalists in CAESAR. it is better than AES-GCM mode in hardware especially in constrained environment (resources and energy consumption) and software (small code size).

Reference: ACORN: A Lightweight Authenticated Cipher (v3)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.