Practically though, if you were to ship (securely) a one tera-byte disk containing random bytes to a friend, then you would have a very safe channel for up to one TB of communication, enough for quite some time.
The function which generates keystream blocks is based on a 512-bit permutation function. A permutation is, by definition, bijective.
The inverse of this permutation particular is trivial to implement in software. Just perform the individual operations (add, rotate, XOR) in reverse order, replacing modular addition with modular subtraction and reversing the ...
There are no known attacks as of now.
With a known plaintext you can get the keystream by XORing plaintext with ciphertext.
But as keystream = matrix-before-any-rounds (input state)+ matrix-after-20-rounds (the mixed ARXed state.)
You cannot separate them easily to get the key.
First, there's no issue with modern stream cipher constructions - either using an AEAD block cipher mode of operation such as GCM, or the combination of ChaCha20-Poly1305 as Google had experimented and subsequently formalized in the form of Internet RFC documents.
Stream ciphers are basically reduced-capability one-time-pads as one may infer: stream cipher ...