Keystream — pseudorandom sequences used to encrypt data

What a keystream looks like

Keystream elements can appear in several forms depending on the cipher and the medium. Common unit sizes are single binary bits, 8-bit bytes, numeric values in a defined range, or printable characters. The combining operation between keystream element and plaintext element is usually addition, subtraction, or the bitwise exclusive-or (XOR); these are typically performed under modular rules (for example, addition modulo 256 or modulo 2), i.e., modular arithmetic, so that the operation is reversible when the same keystream is known.

How keystreams are produced

There are two broad approaches to keystream generation. The first is truly random output, as used in an ideal one-time pad, where a private random sequence as long as the message gives information-theoretic security when used only once. The second approach uses deterministic algorithms—pseudorandom generators—seeded with a secret key to produce streams that are computationally indistinguishable from random. These deterministic generators are the foundation of modern stream ciphers.

• True-random keystreams: high security when single-use, impractical for large messages.
• Pseudorandom keystreams: reproducible from a key, practical for many protocols.
• Block-cipher-based keystreams: modes that convert block ciphers into stream producers.

One common method to obtain a keystream from a block cipher is counter-based operation: the cipher encrypts successive counter values to produce a sequence of blocks, which are then used like a keystream. This construction is often referred to as CTR mode (also known as integer counter mode) and is one way to turn a block primitive into a stream generator; it is one of several ways block ciphers can support streaming operation.

Security and operational considerations

The principal security rule for keystreams is simple and absolute: reuse of the same keystream for two different plaintexts can leak information and in many cases allows efficient recovery of both messages. This is why protocols using one-time pad demand never to repeat the pad, and why stream cipher designers and users must ensure non-repeating IVs or counters. Other practical concerns include the quality of the pseudorandom generator, resistance to key-recovery attacks, and correct handling of synchronization between sender and receiver.

Applications and notable facts

Keystreams appear in many real-world systems: lightweight stream ciphers in constrained devices, transport-layer encryption modes that use CTR, and secure voice or radio links that require continuous keystream production. While the theoretical one-time pad gives perfect secrecy with an ideal keystream, most deployed systems rely on keyed algorithms that trade off perfect secrecy for practicality and manageable key sizes.

For further reading on the concepts and implementations mentioned here, consult introductory material on cryptography, descriptions of stream ciphers and the block ciphers that can be used to produce keystreams, and classic treatments of the one-time pad and modes such as CTR. Understanding how keystreams are generated and applied is essential when evaluating the security of an encryption scheme.