Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Block ciphers have modes like GCM or OCB that combine primitives to provide both authentication and encryption.
Are there similar constructs for stream ciphers, which provide both authentication and encryption using only one cryptographic primitive - actual stream cipher (or keystream)?
An OCB like mode seems impossible with stream-ciphers. It's coupled tightly to the concept of a keyed permutation i.e. a (tweakable) block-cipher.
Many authenticated encryption actually combine two distinct primitives. It's just that the specification and API only expose the combination.
Essentially these xor a key-stream into the message to encrypt it (i.e. they use a synchronous stream cipher), and then authenticate the ciphertext using a MAC. Often they use part of the key-stream as one-time keys for the MAC.
AES-GCM is built by combining a polynomial one-time MAC called GHash with the stream cipher AES-CTR.
While AES itself is a block cipher, AES-CTR behaves like a stream cipher. GCM doesn't use AES in a way that'd prevent the use of a stream cipher.
Then there are some stream ciphers which provide authentication without a separate primitive. These constructions aren't synchronous stream ciphers, and can't be used together with a one-time-pad or plain key-stream.
extending to the top answer
ACORN (lightweight authenticated cipher) is a stream-based AE scheme and is one of the finalists in CAESAR. it is better than AES-GCM mode in hardware especially in constrained environment (resources and energy consumption) and software (small code size).
