63 votes
Accepted

Why do 5G, 4G, etc., use non-conventional algorithms?

These decisions are driven by silicon. Most specifications for hardware are built around a minimally viable CMOS implementation (ex: MPEG-1, lightweight cryptography via NIST 8114). This is ...
user avatar
  • 4,234
16 votes
Accepted

Dancing confusion with Daniel J. Bernstein's stream ciphers

XSalsa20 uses the same cryptographic core as Salsa20 and comes with a security proof that it's secure if Salsa20 is secure. It doesn't use the core of ChaCha and thus has worse diffusion. The way ...
user avatar
16 votes
Accepted

Why do stream ciphers use a nonce?

By the modern definition of a cipher, it must be possible to encipher several messages with the same secret key. That's also a practical necessity, due to the difficulty of securely establishing a ...
user avatar
  • 124k
13 votes
Accepted

What does a stream cipher provide that cannot be obtained with AES CTR mode operation?

AES-CTR is a stream cipher, of a particular kind where the keystream is obtained by encryption of a counter. So the question reduces to: what are drawbacks of AES-CTR compared to other stream ciphers? ...
user avatar
  • 124k
13 votes
Accepted

Which cipher is used in the new 5G network?

Ericson's white paper lists them as The strong and well-proven security algorithms from the 4G system are reused. These are encryption algorithms based on SNOW 3G, AES-CTR, and ZUC; and integrity ...
user avatar
  • 43.4k
12 votes
Accepted

What do you call one time pad where pseudo-random numbers are used?

Synchronous stream cipher, or just stream cipher. In a synchronous stream cipher a stream of pseudo-random digits is generated independently of the plaintext and ciphertext messages, and then ...
user avatar
  • 168
12 votes
Accepted

Functional difference between stream cipher, XOF, seed expander, KDF, etc

Before we start answering the subquestions, let's bring up some background knowledge. The sponge construct was first proposed by the Keccak team as a bridging element in a security proof for the ...
user avatar
  • 6,621
12 votes
Accepted

Stream Cipher Key Stream from Successive Hashes

The Insecurity of Proposed Scheme It is not as secure as it seems, in modern cryptography standards it is totally insecure. It is vulnerable to basic Known-Plaintext attacks (KPA) and in Modern ...
user avatar
  • 43.4k
11 votes
Accepted

Dan Boneh's Cryptography lecture - problem with 802.11b

...wouldn't key still get repeated every few hours or so - i.e. you come to the end of the PRG(K)... This is where you are mistaken. Modern cryptographic PRGs simply do no repeat within any ...
user avatar
  • 2,575
11 votes

Are common (secure) stream ciphers CCA1-secure?

For stream ciphers, IND-CCA1 and IND-CPA security differ precisely in that an attacker can choose the IV in the CCA1 game (because that's part of the ciphertext that can be submitted to the decryption ...
user avatar
  • 124k
10 votes

Why are there so many stream ciphers out there and even ongoing research?

Many stream ciphers work by transforming a short key (and optionally a nonce) into a long key-stream that's xor-ed into the plaintext to produce the ciphertext, which is exactly the construction you'...
user avatar
9 votes
Accepted

How secure is Salsa20?

Pulling information from the wikipedia entry on Salsa20: eSTREAM selection Salsa20 has been selected as a Phase 3 design for Profile 1 (software) by the eSTREAM project, receiving the highest ...
user avatar
  • 19.2k
9 votes
Accepted

Are common (secure) stream ciphers CCA1-secure?

Let's consider CTR mode encryption with a random IV for a block cipher (essentially the same as stream cipher, but simpler to analyze since the formalization of stream cipher security is not fully ...
user avatar
9 votes

OTP stream cipher

"Is it possible to actually obtain a key by XORING message(plaintext) and ciphertext?" Of course it is; it's actually pretty easy. On the other hand, those specific key bits were used once; their ...
user avatar
  • 132k
9 votes
Accepted

Using weak hash functions to construct a stream cipher

As long as your encoding of $K$, $N$, and $i$ is injective (i.e., for each encoded string you can uniquely derive $K$, $N$, and $i$) and fixed-length, this is almost certainly a decent stream cipher. ...
user avatar
9 votes
Accepted

What is the significance of IV in stream ciphers like Trivium?

Role of IV in stream cipher? Like in block ciphers; it helps to achieve randomized encryption. Also, using different IV under the same key prevents the crib-dragging attack like in all stream ...
user avatar
  • 43.4k
8 votes
Accepted

Attack an stream cypher using 2 XORed LFSRs

The fundamental property that you will use is that the output of an $A$-bit LSFR (using the $A$-bit feedback polynomial $P$) xored with the output of a $B$-bit LSFR (using the $B$-bit polynomial $Q$) ...
user avatar
  • 132k
8 votes
Accepted

AES GCM vs other encryption modes in embedded environment for network traffic

If you are constrained by the embedded environment, you should consider CCM instead of GCM as AES mode. One of the major constrain when implementing GCM is that the authentication part (the GHASH) is ...
user avatar
  • 6,339
8 votes
Accepted

What happens when a RC4 stream gets corrupted?

If a large file enciphered using RC4 is partially corrupted, the uncorrupted portions remains fully decipherable, including what's after a corrupted portion if the corruption modifies this data's ...
user avatar
  • 124k
8 votes
Accepted

Stream Ciphers and cycling questions

A PRNG has an internal finite state. The value of that state determines all subsequent outputs; that's the point of the PRNG being a deterministic engine. Whenever the PRNG produces a new output ...
user avatar
8 votes
Accepted

AES in Counter mode for 64 bit input

The idea of a counter stream mode of AES is to generate an random stream of bits by chunk of 128 bits but you are not forced to use all the 128 bits of it. To encrypt the process is the following, ...
user avatar
  • 9,799
8 votes

Fast crytographically secure Pseudo-Random number generator in software

What are the methods for generating pseudo-random numbers in software? What are the other methods available for fast pseudo random number generation? If you don't need to be able to repeat the stream ...
user avatar
  • 19.2k
8 votes
Accepted

How long does a good AES encryption take?

From this answer Different ways/algorithms for implementing AES you can see that AES is already pretty fast. By using the hardware instruction you can even get down to $\sim1.3$ cycles/byte[1]. $1 GB ...
user avatar
  • 9,799
8 votes
Accepted

Why aren't stream ciphers extremely secure?

Yes, stream cipher is to OTP what CSPRNG is to true randomness. Yes, breaking a stream cipher implemented with CSPRNGs XORed together (each independently seeded) demonstrably implies breaking each ...
user avatar
  • 124k
8 votes

What is the difference between a Stream cipher and a Symmetric Encryption algorithm?

There are multiple ways to do symmetric encryption. The two most popular ones are block ciphers and stream ciphers. So stream ciphers are a subset of symmetric ciphers. AES and 3DES are block ciphers,...
user avatar
  • 2,458
8 votes

How secure is the E0 stream cipher used in Bluetooth?

Bluetooth has gone through a few transitions in protocol. Bluetooth BR/EDR uses E0/SAFER for a cipher and Bluetooth LE uses AES-CCM. Fundamentally, when you write a specification as an engineer, ...
user avatar
  • 4,234
8 votes
Accepted

What Cipher Suite in this list is the worst to use

Assuming you are actually asking whether any cipher suite is objectively worse than the others, the answer is clear: TLS_RSA_WITH_3DES_EDE_CBC_SHA. Why? Well, this ...
user avatar
  • 44.6k
7 votes
Accepted

Determine LFSR phase quickly?

Well, one way to look at this is to notice that, if the feedback polynomial is prime, then the result of starting with state $E$, and then stepping the LFSR forward $N$ steps is the value $2^N \cdot E$...
user avatar
  • 132k
7 votes
Accepted

Security analysis of Spritz?

I have looked at some attacks on RC4 and be curious if some of them can be applied to Spritz as well. Does anybody else has analysed Spritz so far? Or is it far too early for results against Spritz? ...
user avatar
  • 31.3k
7 votes
Accepted

Are all stream-ciphers IND-CPA?

No. There is a difference between the type of a cipher and the construction of a cipher. If a cipher is of a specific type for which there are known IND-CPA secure constructions then that doesn't ...
user avatar
  • 85.2k

Only top scored, non community-wiki answers of a minimum length are eligible