Editing Stream cipher (section)

==Security==
{{main|Stream cipher attacks}}

For a stream cipher to be secure, its keystream must have a large [[periodic function|period]], and it must be impossible to ''recover the cipher's key'' or internal state from the keystream. Cryptographers also demand that the keystream be free of even subtle biases that would let attackers ''distinguish'' a stream from random noise, and free of detectable relationships between keystreams that correspond to ''related keys'' or related [[cryptographic nonce]]s. That should be true for all keys (there should be no ''[[weak key]]s''), even if the attacker can ''know'' or ''choose'' some ''plaintext'' or ''ciphertext''.

As with other attacks in cryptography, stream cipher attacks can be ''certificational'' so they are not necessarily practical ways to break the cipher but indicate that the cipher might have other weaknesses.

Securely using a secure synchronous stream cipher requires that one never reuse the same keystream twice. That generally means a different [[Cryptographic nonce|nonce]] or key must be supplied to each invocation of the cipher. Application designers must also recognize that most stream ciphers provide not ''authenticity'' but ''privacy'': encrypted messages may still have been modified in transit.

Short periods for stream ciphers have been a practical concern. For example, 64-bit block ciphers like [[Data Encryption Standard|DES]] can be used to generate a keystream in [[output feedback]] (OFB) mode. However, when not using full feedback, the resulting stream has a period of around 2<sup>32</sup> blocks on average; for many applications, the period is far too low. For example, if encryption is being performed at a rate of 8 [[megabyte]]s per second, a stream of period 2<sup>32</sup> blocks will repeat after about an hour.

Some applications using the stream cipher [[RC4]] are attackable because of weaknesses in RC4's key setup routine; new applications should either avoid RC4 or make sure all keys are unique and ideally [[related key|unrelated]] (such as generated by a well-seeded [[Cryptographically secure pseudorandom number generator|CSPRNG]] or a [[cryptographic hash function]]) and that the first bytes of the keystream are discarded.

The elements of stream ciphers are often much simpler to understand than block ciphers and are thus less likely to hide any accidental or malicious weaknesses.