Field Guide · algorithm

Also known as: stream cipher

A stream cipher encrypts data one bit or byte at a time by combining each unit of plaintext — almost always with XOR — against a pseudo-random keystream generated from a secret key.1 It contrasts with a block cipher, which transforms fixed-size blocks at once. Because the same keystream both masks and unmasks the data, a stream cipher is inherently symmetric: sender and receiver must share the key and stay bit-aligned on the stream.

keystream gen ⊕ plaintext ciphertext
A stream cipher XORs each plaintext bit with a keystream bit; the same operation decrypts.

How it works

A stream cipher’s strength lives entirely in its keystream generator. The key (usually with a nonce or initialization vector) seeds a state machine that emits a long pseudo-random sequence; XORing that sequence with the plaintext gives the ciphertext, and XORing the same sequence with the ciphertext recovers the plaintext, because XOR is its own inverse. The ciphertext is exactly the length of the plaintext — there is no block padding and no expansion, which is one reason stream ciphers suit continuous, byte-by-byte data like digitized voice.

Two rules follow directly from the XOR structure:

  • Never reuse a keystream. If two messages are encrypted under the same keystream, XORing the two ciphertexts cancels the keystream and leaks the XOR of the two plaintexts — the “two-time pad” break. This is why a stream cipher pairs its key with a per-message nonce or IV so that every message runs off a fresh keystream.
  • The keystream must look random. A predictable generator lets an attacker reconstruct the sequence without the key. A bare linear-feedback shift register fails here — its output is linear and can be solved from a short run of known bits — so real designs add nonlinearity. The one-time pad is the idealized limit: a truly random keystream as long as the message, provably unbreakable but impractical because the key is as large as the data.

Variants

Stream ciphers split into two families by how the keystream depends on the message:

  • Synchronous — the keystream is generated purely from the key and nonce, independent of the plaintext or ciphertext. Sender and receiver must stay perfectly synchronized; a lost or inserted bit desynchronizes the stream and garbles everything after it, so these ciphers need framing or resynchronization. RC4 and ChaCha20 are synchronous.
  • Self-synchronizing (asynchronous) — each keystream unit is computed from the last few ciphertext bits, so after a bit slip the cipher automatically re-locks within a fixed window. Cipher-feedback (CFB) mode of a block cipher is the classic example.

A distinct and very common variant is a block cipher run as a stream cipher. In Output-Feedback (OFB) and Counter (CTR) modes, the block cipher is never applied to the plaintext at all — it is repeatedly encrypted over a feedback register (OFB) or an incrementing counter (CTR) to manufacture a keystream, which is then XORed with the data. This lets a strong, well-studied block cipher such as AES or DES protect an arbitrary-length stream while behaving, on the wire, exactly like a stream cipher.2

In practice

CTR mode is now the workhorse: it is parallelizable, allows random access into the stream, and only needs the block cipher’s forward (encrypt) direction. Its one hard requirement is a never-repeating counter/nonce per key — repeat it and you are back to the two-time-pad break above. Modern authenticated modes (GCM) wrap CTR with a message-authentication tag so that tampering is detected, closing the malleability weakness where flipping a ciphertext bit predictably flips the same plaintext bit.

Relevance to SDR

Stream ciphers are the encryption scheme most often seen on the trunked systems GopherTrunk monitors. DMR “Enhanced Privacy” uses RC4, and P25 voice can be protected with DES-OFB or AES — both run their underlying block cipher in a feedback mode that turns it into a keystream generator, so the on-air result is a synchronous stream cipher applied to the vocoder frames. Without the key the keystream cannot be reproduced, so GopherTrunk can detect and follow an encrypted call but cannot recover the audio — distinct from reversible scrambling, where the whitening sequence is public and keyless.

Sources

  1. Stream cipher — Wikipedia, for the per-symbol XOR-with-keystream model, synchronous vs self-synchronizing families, and the keystream-reuse pitfall. ↩

  2. SP 800-38A, Recommendation for Block Cipher Modes of Operation — NIST, for OFB and CTR modes that turn a block cipher into a keystream generator. ↩

See also