In a stream cipher, the keystream is usually XORed with the plaintext, which is a 1-bit key-dependent bijective operation (ie, if the key bit is 0, 0->0 and 1->1, whereas if it is 1, 0->1 and 1->0). I have seen, eg, bytewise addition discussed here ([Can I safely replace XOR with ADD in a stream cipher?][1]) as having minimal security benefit ("If your stream cipher is so broken that this makes a difference, run." – [CodesInChaos][2]) and sounds like it would still be nearly as vulnerable to a malleability attack or keystream-reuse attack, but what about a more non-linear bijective function? For example, multiplication mod 257 or 65537 (with the all-0s value taken as -1 as in IDEA), where 8/16 bits of plaintext is turned into 8/16 bits of ciphertext dependent on 8/16 bits of keystream? Would that get rid of malleability or would it replace it with multiplicative malleability? And would it still be trivial to break with a reused keystream? EDIT: Okay, I think this one is a bust on further reflection. Instead of P1 XOR P2, you get P1*(P2^-1), which I assume is almost as easy to break (P1 and P2 being the two plaintexts encrypted with the same key), and the malleability becomes multiplying the ciphertext by Pa*(P1^-1) to get P1*K1*Pa*(P1^-1) = Pa*K1 (where P1 is the original plaintext and Pa is the attacker's desired decryption). And I think this applies to any commutative arithmatic function. END EDIT Or, more generally, an S-box-like construction where n bits of keystream select between 2^n bijective n-bit transforms (like the DES S-boxes where each row was required to be bijective, per criterion S-3 [here][3])? Does that get rid of the malleability attack entirely, as long as the box is well-designed? And would it make the key-reuse attack harder? (I am assuming that the box contents are known to the attacker and all of the security is in the keystream bits) And would either idea introduce any obvious vulnerabilities? (This question concerns science fiction I am writing, so you can assume it's implemented without side-channel attacks) [1]: https://crypto.stackexchange.com/questions/1666/can-i-safely-replace-xor-with-add-in-a-stream-cipher [2]: https://crypto.stackexchange.com/questions/1666/can-i-safely-replace-xor-with-add-in-a-stream-cipher#comment22509_1669 [3]: http://simson.net/ref/1994/coppersmith94.pdf