Stream Ciphers

Kerckhoffs’s principle: a cryptosystem must remain secure even if everything about the system, except the key, is public knowledge.

Since security depends only on the key, the key space must be large enough to make an exhaustive key search infeasible.

Stream Cipher

Models plaintext as a bit stream, combined with a random keystream via a reversible operation, bitwise XOR.

Both encryption and decryption must generate the identical keystream $k_i$.

• No error propagation
  A bit error in a transmitted ciphertext bit corrupts only the corresponding decrypted plaintext bit.
• Efficient for real-time data (audio, video streaming) when the keystream generation algorithm is fast.

One-Time Pad

A keystream that is different for every message and as long as the message is perfectly secure.

Keystream Generator

Practical stream ciphers use a keystream generator: a short secret key expands into a stream of pseudorandom bits $k_0, k_1, k_2, \dots$.

A secure keystream generator must satisfy:

• Long period
  The period $N$ of the repetition of the sequence, where $k_i = k_{i+N}$, must be large for all $i$.
• Pseudo-randomness
  The sequence must pass statistical random number tests.
• Unpredictability
  Computationally infeasible to determine the full keystream from any part of it, of any length.

Attacking a Stream Cipher

Reusing a key produces related ciphertexts for different messages.

An attacker who captures ciphertext streams can construct a new ciphertext, without knowing the key, that decrypts predictably. This is an existential forgery attack.

Lorenz Cipher

A stream cipher, manufactured by C. Lorenz AG, that encrypts a Baudot-coded plaintext bit stream into 5 ciphertext bit streams.

Encryption XORs the 5-bit Baudot code with a 5-bit random sequence, generated by 12 shift registers in 3 groups:

• 5 $\chi$ registers, lengths 41, 31, 29, 26, 23.
• 5 $\psi$ registers, lengths 43, 47, 51, 53, 59.
• 2 $\mu$ registers, lengths 61, 37.

At each clock tick $t$:

• $K = (\chi_i \oplus \psi_i)$ for $i = 1, \dots, 5$.
• $t \leftarrow t + 1$, and the $\chi$ registers advance.
• $\mu^{(1)}$ advances every tick, and conditionally triggers $\mu^{(2)}$ to advance.
• $\mu^{(2)}$ conditionally triggers the $\psi$ registers to advance.
• Output $K$.

Key space: