A stream cipher encrypts plaintext one bit or byte at a time by XORing it with a generated keystream. It targets confidentiality in constrained devices and high-performance systems such as real-time video calls. section 4.0 section 5.6
A short seed initializes a cryptographically secure pseudorandom number generator (CSPRNG). Its output supplies as much keystream as needed, while the seed remains the fixed-length key. Recovering keystream bytes from known plaintext should not reveal the seed or predict future output. section 4.1.2
Equation 4.1
\[\text{Plaintext} \oplus \text{Key} = \text{Ciphertext} \label{equation:encrypt-xor}\]The core operation combines plaintext and keystream with XOR to produce ciphertext. section 4.1.2
Treat these implementation rules as security boundaries:
- Never reuse the same keystream for two messages: XORing the ciphertexts exposes the XOR of their plaintexts. section 4.1.2 section 4.4
- Prefer a CSPRNG over a directly generated or predictable key stream; ordinary linear feedback shift registers can be reversed from their linear output. section 4.1.2 section 4.4
- Do not treat RC4 as safe merely because it is simple: statistical biases in its Wi-Fi use enabled recovery of WEP passwords. section 4.3 section 4.4
Encrypting a large video
A one-time pad for a 1 GB video requires sharing a 1 GB random key. A stream cipher instead shares a CSPRNG seed; both parties generate matching 1 GB keystreams locally and XOR them with the video. section 4.1.2
