64 votes
Accepted

Why do 5G, 4G, etc., use non-conventional algorithms?

These decisions are driven by silicon. Most specifications for hardware are built around a minimally viable CMOS implementation (ex: MPEG-1, lightweight cryptography via NIST 8114). This is ...
b degnan's user avatar
  • 4,722
21 votes

why XOR is recommended/Used in every paper I read for encryption and decryption stream cipher?

Why can't I use other opeartions such as NAND, AND, OR Because it needs to be invertible. For example, if you use NAND, then if the bit from the key generator is a 0, then the output of the NAND will ...
poncho's user avatar
  • 146k
15 votes
Accepted

Which cipher is used in the new 5G network?

Ericson's white paper lists them as The strong and well-proven security algorithms from the 4G system are reused. These are encryption algorithms based on SNOW 3G, AES-CTR, and ZUC; and integrity ...
kelalaka's user avatar
  • 48.3k
13 votes
Accepted

Functional difference between stream cipher, XOF, seed expander, KDF, etc

Before we start answering the subquestions, let's bring up some background knowledge. The sponge construct was first proposed by the Keccak team as a bridging element in a security proof for the ...
DannyNiu's user avatar
  • 9,080
12 votes
Accepted

Stream Cipher Key Stream from Successive Hashes

The Insecurity of Proposed Scheme It is not as secure as it seems, in modern cryptography standards it is totally insecure. It is vulnerable to basic Known-Plaintext attacks (KPA) and in Modern ...
kelalaka's user avatar
  • 48.3k
12 votes
Accepted

Is Trivium still secure?

There is no better than brute force attack in the open literature on the full version of Trivium which consists of 1152 "rounds" (iterations of the state machine after loading with the key ...
kodlu's user avatar
  • 22.1k
11 votes

Are common (secure) stream ciphers CCA1-secure?

For stream ciphers, IND-CCA1 and IND-CPA security differ precisely in that an attacker can choose the IV in the CCA1 game (because that's part of the ciphertext that can be submitted to the decryption ...
fgrieu's user avatar
  • 140k
11 votes

Is Trivium still secure?

I would say that Trivium is still secure, but the ASIC example given in the paper is not. The security of an ASIC implementation is only as good as the person who created the design for the ASIC. ...
b degnan's user avatar
  • 4,722
10 votes
Accepted

How long does a good AES encryption take?

From this answer Different ways/algorithms for implementing AES you can see that AES is already pretty fast. By using the hardware instruction you can even get down to $\sim1.3$ cycles/byte[1]. $1 GB ...
Biv's user avatar
  • 9,979
10 votes
Accepted

What is the significance of IV in stream ciphers like Trivium?

Role of IV in stream cipher? Like in block ciphers; it helps to achieve randomized encryption. Also, using different IV under the same key prevents the crib-dragging attack like in all stream ...
kelalaka's user avatar
  • 48.3k
9 votes
Accepted

How secure is Salsa20?

Pulling information from the wikipedia entry on Salsa20: eSTREAM selection Salsa20 has been selected as a Phase 3 design for Profile 1 (software) by the eSTREAM project, receiving the highest ...
Ella Rose's user avatar
  • 19.6k
9 votes
Accepted

Are common (secure) stream ciphers CCA1-secure?

Let's consider CTR mode encryption with a random IV for a block cipher (essentially the same as stream cipher, but simpler to analyze since the formalization of stream cipher security is not fully ...
Yehuda Lindell's user avatar
9 votes

OTP stream cipher

"Is it possible to actually obtain a key by XORING message(plaintext) and ciphertext?" Of course it is; it's actually pretty easy. On the other hand, those specific key bits were used once; their ...
poncho's user avatar
  • 146k
9 votes

How secure is the E0 stream cipher used in Bluetooth?

Bluetooth has gone through a few transitions in protocol. Bluetooth BR/EDR uses E0/SAFER for a cipher and Bluetooth LE uses AES-CCM. Fundamentally, when you write a specification as an engineer, ...
b degnan's user avatar
  • 4,722
9 votes
Accepted

Using weak hash functions to construct a stream cipher

As long as your encoding of $K$, $N$, and $i$ is injective (i.e., for each encoded string you can uniquely derive $K$, $N$, and $i$) and fixed-length, this is almost certainly a decent stream cipher. ...
Squeamish Ossifrage's user avatar
9 votes
Accepted

Can you use SHAKE256_XOF with XOR to make a stream cipher?

In section 3.2 "Modes of use of sponge functions" of Cryptographic Sponge Functions (CSF for short for the purpose of this answer), the authors listed several "modes of operations" ...
DannyNiu's user avatar
  • 9,080
9 votes
Accepted

Is there a security risk to use AES-CBC as stream cipher?

"AES-CBC mode to encrypt `0's to generate blocks of the one-time pad and then use that one-time pad stream to encrypt plain text through XOR" is effectively AES-OFB. It's fine for ...
fgrieu's user avatar
  • 140k
8 votes
Accepted

How distinct are the meanings of the terms "CSPRNG," "DRBG" and "stream cipher"?

The definitions are not all universal and there is quite some overlap. The clearest definition is for PRG, which is the (synchronous) stream cipher model. A PRG maps a secret value to a long, random-...
otus's user avatar
  • 32.1k
8 votes
Accepted

AES in Counter mode for 64 bit input

The idea of a counter stream mode of AES is to generate an random stream of bits by chunk of 128 bits but you are not forced to use all the 128 bits of it. To encrypt the process is the following, ...
Biv's user avatar
  • 9,979
8 votes

Fast crytographically secure Pseudo-Random number generator in software

What are the methods for generating pseudo-random numbers in software? What are the other methods available for fast pseudo random number generation? If you don't need to be able to repeat the stream ...
Ella Rose's user avatar
  • 19.6k
8 votes
Accepted

Why aren't stream ciphers extremely secure?

Yes, stream cipher is to OTP what CSPRNG is to true randomness. Yes, breaking a stream cipher implemented with CSPRNGs XORed together (each independently seeded) demonstrably implies breaking each ...
fgrieu's user avatar
  • 140k
8 votes

What is the difference between a Stream cipher and a Symmetric Encryption algorithm?

There are multiple ways to do symmetric encryption. The two most popular ones are block ciphers and stream ciphers. So stream ciphers are a subset of symmetric ciphers. AES and 3DES are block ciphers,...
mat's user avatar
  • 2,508
8 votes
Accepted

What Cipher Suite in this list is the worst to use

Assuming you are actually asking whether any cipher suite is objectively worse than the others, the answer is clear: TLS_RSA_WITH_3DES_EDE_CBC_SHA. Why? Well, this ...
SEJPM's user avatar
  • 45.9k
8 votes

How secure is ChaCha20?

Aumasson et al. Showed that ChaCha6 can be attacked with time complexity $2^{139}$ and ChaCha7 with $2^{248}$. Shi et al. gave an attack based on second-order differential with $2^{136}$ for ChaCha6 ...
kelalaka's user avatar
  • 48.3k
8 votes

Does ChaCha20 counter actually increment through iterations?

You seem a bit confused about how the various parts of the ChaCha20 cipher actually fit together, so let me start from the top down and see if I can clarify things. At the highest level, the ChaCha20 ...
Ilmari Karonen's user avatar
8 votes
Accepted

Is a stream cipher and a (cryptographically secure) PRNG nearly the same thing?

Stream cipher and CSPRNG aren't the same thing. CSPRNGs must handle initial seeding, post-compromise reseeding, back-tracing resistance among other things; stream ciphers only need to be able to ...
DannyNiu's user avatar
  • 9,080
8 votes

why XOR is recommended/Used in every paper I read for encryption and decryption stream cipher?

Edit: For any additive group operation, including addition modulo $k$ if the added keystream symbols $z_t$ are uniformly distributed, which means $$ Pr(z_t=a)=1/k, \quad \forall a \in \{0,\ldots, k-1\...
kodlu's user avatar
  • 22.1k
8 votes

A modern rotor machine, could it be any safe?

No, modern standards for symmetric cryptography are heavily over-engineered and the power of chosen plaintext attacks/chosen ciphertext attacks can quickly uncover the structure of such a variant ...
Daniel S's user avatar
  • 22.9k
7 votes
Accepted

Does XChaCha20 exist with similar properties to XSalsa20?

Unfortunately, there is no specification for XChaCha20. But several implementations provide a HChaCha20 function, built the same way as HSalsa20. XChaCha20 can be built with HChaCha20 + ChaCha20, and ...
Frank Denis's user avatar
  • 2,944

Only top scored, non community-wiki answers of a minimum length are eligible