Cryptology Academy · Lesson

Stream Cipher Concepts & PRNG

Learn how stream ciphers generate a keystream from a seed.

Stream Cipher Concepts & PRNG is a free Cryptology Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

Stream ciphers generate a pseudorandom keystream from a key and encrypt byte by byte. In this lesson we understand how keystreams work and what makes a stream cipher secure.

Stream Cipher Model

KeyGen(K, Nonce) → keystream K1, K2, K3, ... Ci = Pi XOR Ki Pi = Ci XOR Ki Encryption and decryption are identical: XOR with the keystream. The keystream must be pseudorandom and never reused.

PRNG vs CSPRNG

PRNG (Pseudorandom Number Generator): deterministic output that looks random. NOT cryptographically secure — statistical tests pass but output is predictable with enough samples. CSPRNG: cryptographically secure — output is computationally indistinguishable from random even with unlimited compute.

Security Requirements

A secure stream cipher keystream must be: 1. Computationally indistinguishable from random 2. Different for each (key, nonce) pair 3. Impossible to predict from partial output 4. Not invertible — cannot derive key from keystream

Linear Congruential Generators (Insecure)

LCG: s(n+1) = (a × s(n) + c) mod m. Used in many rand() implementations. Completely insecure for crypto — knowing a few outputs reveals all future and past outputs mathematically.

Seed Size and Security

A stream cipher keystream is only as secure as its seed (key). A 128-bit key provides 128-bit security regardless of how much keystream is generated. The seed is the entropy source.

Synchronous vs Self-Synchronizing

Synchronous: keystream is independent of plaintext/ciphertext (RC4, ChaCha20). Self-synchronizing: keystream depends on previous ciphertext (CFB mode). Lost bits desynchronize synchronous ciphers.

Key Stream Generation Architecture

Most modern stream ciphers use: 1. Key + Nonce → initial state 2. Permutation function applied repeatedly to state 3. Some state bits output as keystream 4. Counter incremented for next block AES-CTR follows this pattern.

eSTREAM Portfolio

The eSTREAM project (2004-2008) standardized stream ciphers. Software finalists: HC-128, Rabbit, Salsa20/12, SOSEMANUK. Salsa20 led to ChaCha20, now the dominant stream cipher.

Keystream Reuse: Fatal Flaw

The cardinal sin of stream ciphers: never reuse (key, nonce). C1 XOR C2 = P1 XOR P2. Multiple WEP packets with the same IV (equivalent to key+nonce) allowed complete decryption.

Stream Cipher vs Block Cipher in CTR Mode

AES-CTR is a block cipher used as a stream cipher. Dedicated stream ciphers (ChaCha20) are often faster in software. Security properties are similar when properly keyed and nonced.

Quick Check

What is the fundamental vulnerability when a stream cipher's (key, nonce) pair is reused?

Recap

Stream cipher fundamentals are clear. Next we study RC4 in depth — how it works and the devastating weaknesses that retired it.

Frequently asked questions

Is the “Stream Cipher Concepts & PRNG” lesson free?

Yes — the full text of “Stream Cipher Concepts & PRNG” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “Stream Cipher Concepts & PRNG”?

Learn how stream ciphers generate a keystream from a seed. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Stream Cipher Concepts & PRNG” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cryptology Academy