Stream Ciphers

Stream ciphers encrypt data by generating a pseudorandom keystream from a secret key and combining it with the plaintext, typically one bit or byte at a time, emulating the perfectly secure one-time pad with a short key.

Definition

A stream cipher is a symmetric encryption scheme that produces a long pseudorandom keystream from a secret key (and usually a nonce) and encrypts by combining the keystream with the plaintext, most commonly by bitwise XOR.

Scope

This topic covers the design and analysis of stream ciphers: keystream generators built from linear feedback shift registers, combiner and filter constructions, and modern software-oriented designs such as ChaCha20 and the eSTREAM portfolio. It addresses the relationship to the one-time pad, the critical requirement never to reuse a keystream, and attacks arising from keystream reuse or weak generators. It excludes block ciphers, though a block cipher in counter mode effectively functions as a stream cipher.

Core questions

• How can a short key be stretched into a long, unpredictable keystream that mimics a one-time pad?
• Why is reusing a keystream catastrophic, and how do nonces prevent it?
• What makes a keystream generator cryptographically strong rather than merely statistically random?
• How do modern stream ciphers like ChaCha20 achieve speed without dedicated hardware?
• What classical attacks (correlation, algebraic) break weak LFSR-based designs?

Key concepts

• keystream
• one-time pad
• linear feedback shift register
• nonce and initialization vector
• keystream reuse (two-time pad)
• ChaCha20 and Salsa20
• correlation attacks
• synchronous vs self-synchronizing ciphers

Key theories

One-time pad and perfect secrecy

Encrypting by XOR with a truly random key as long as the message achieves Shannon's perfect secrecy; stream ciphers approximate this by substituting a pseudorandom keystream for the impractical truly random pad.

Keystream generation and cryptographic pseudorandomness

A secure stream cipher is a pseudorandom generator: its keystream must be computationally indistinguishable from random, so that no efficient adversary can predict future keystream bits even after observing many.

Mechanisms

A synchronous stream cipher initializes an internal state from the key and nonce, then repeatedly updates the state and emits keystream output independent of the plaintext. The keystream is XORed with plaintext to encrypt and with ciphertext to decrypt. Designs based on linear feedback shift registers are fast in hardware but require nonlinear combiners to resist algebraic attacks; software ciphers like ChaCha20 use addition-rotation-XOR (ARX) operations on a large state for speed and security.

Clinical relevance

ChaCha20 (with the Poly1305 authenticator) is widely deployed in TLS 1.3, OpenSSH, WireGuard, and mobile messaging, where it is preferred over AES on devices lacking hardware AES acceleration. Stream ciphers are well suited to streaming media and low-latency links. Historically, the RC4 stream cipher protected early SSL/TLS and WEP Wi-Fi until its biases led to deprecation.

Evidence & guidelines

ChaCha20-Poly1305 is standardized in RFC 8439 and approved for TLS. RC4 is prohibited in TLS by RFC 7465 due to keystream biases. The eSTREAM project (2004-2008) produced a vetted portfolio of stream ciphers. The cardinal rule across all standards is that a (key, nonce) pair must never be reused.

History

Stream ciphers descend from the Vernam cipher (1917) and the one-time pad. Cold-war military systems used keystream generators based on shift registers. RC4, designed by Ron Rivest in 1987, became enormously widespread but was eventually broken in its protocol uses. The eSTREAM competition and Daniel Bernstein's Salsa20/ChaCha20 family (2008) defined the modern, software-friendly generation now favored in internet protocols.

Key figures

• Claude Shannon
• Daniel J. Bernstein
• Ronald Rivest
• Adi Shamir

Seminal works

• shannon1949
• katz2020
• menezes1996

Frequently asked questions

What happens if a stream cipher keystream is reused?

XORing two ciphertexts encrypted with the same keystream cancels the keystream, leaving the XOR of the two plaintexts — which often reveals both messages. This is why every encryption must use a fresh nonce so that the keystream never repeats under a fixed key.

Are stream ciphers less secure than block ciphers?

Not inherently. Modern stream ciphers like ChaCha20 are considered as secure as AES and are sometimes faster in software. Insecurity arises from misuse (keystream reuse) or weak legacy designs such as RC4, not from the stream-cipher concept itself.