Understand et utiliser stream ciphers correctly
Stream ciphers chiffrer octet-par-octet utilisant un keystream, offering speed et aucun padding. Apprendre correct nonce handling et le fatal mistake de nonce reuse.
- 1
A stream cipher generates a pseudorandom keystream and XORs it with the plaintext. The ciphertext is exactly the same length as the plaintext — no padding needed. The critical rule: never reuse a (key, nonce) pair, or the XOR of two ciphertexts reveals the XOR of two plaintexts.
- 2 Chiffreur RC4 →
Chiffrer a short message to see the stream cipher property: ciphertext length equals plaintext length. Observe how the output changes completely with a different key.
- 3 Chiffreur RC4 →
Chiffrer a second message with the SAME key to demonstrate the nonce-reuse catastrophe. XOR the two ciphertexts — the keystream cancels and you get the XOR of the two plaintexts, leaking structural information.
- 4
Modern stream ciphers (ChaCha20, AES-CTR, AES-GCM) use an explicit nonce to vary the keystream per message. Generate a fresh nonce for every encryption — never hardcode it, never reuse it. Use authenticated encryption (AEAD) to detect tampering.
Questions fréquentes
- Why is nonce reuse catastrophic?
- If two messages are encrypted with the same key and nonce, C1 XOR C2 = P1 XOR P2. The keystream cancels out. An attacker who guesses one plaintext recovers the other. This broke WPA2 (KRACK attack).
- Stream cipher vs block cipher — which to use?
- Use AES-GCM (a block cipher in AEAD mode) in most cases. Use ChaCha20-Poly1305 on devices without AES hardware. Never use a raw stream cipher without authentication.