Understand und verwenden stream ciphers correctly
Stream ciphers verschlüsseln Byte-durch-Byte mit ein keystream, offering speed und kein padding. Lernen correct nonce handling und der fatal mistake von nonce reuse.
- 1
A stream cipher generates a pseudorandom keystream and XORs it with the plaintext. The ciphertext is exactly the same length as the plaintext — no padding needed. The critical rule: never reuse a (key, nonce) pair, or the XOR of two ciphertexts reveals the XOR of two plaintexts.
- 2 RC4-Verschlüsseler →
Verschlüsseln a short message to see the stream cipher property: ciphertext length equals plaintext length. Observe how the output changes completely with a different key.
- 3 RC4-Verschlüsseler →
Verschlüsseln a second message with the SAME key to demonstrate the nonce-reuse catastrophe. XOR the two ciphertexts — the keystream cancels and you get the XOR of the two plaintexts, leaking structural information.
- 4
Modern stream ciphers (ChaCha20, AES-CTR, AES-GCM) use an explicit nonce to vary the keystream per message. Generate a fresh nonce for every encryption — never hardcode it, never reuse it. Use authenticated encryption (AEAD) to detect tampering.
Häufige Fragen
- Why is nonce reuse catastrophic?
- If two messages are encrypted with the same key and nonce, C1 XOR C2 = P1 XOR P2. The keystream cancels out. An attacker who guesses one plaintext recovers the other. This broke WPA2 (KRACK attack).
- Stream cipher vs block cipher — which to use?
- Use AES-GCM (a block cipher in AEAD mode) in most cases. Use ChaCha20-Poly1305 on devices without AES hardware. Never use a raw stream cipher without authentication.