Encryption algorithms such as Blowfish,AES,RC4,DES and Seal are implemented in one of two categories of ciphers. What are the advantages/disadvantages to the type of ciphers?


While both are symmetric ciphers, stream ciphers are based on generating an "infinite" cryptograpic keystream, and using that to encrypt one bit or byte at a time (similar to the one-time pad), whereas block ciphers work on larger chunks of data (i.e. blocks) at a time, often combining blocks for additional security (e.g. AES in CBC mode).

  • Stream ciphers are typically faster than block, but that has it's own price.
  • Block ciphers typically require more memory, since they work on larger chunks of data and often have "carry over" from previous blocks, whereas since stream ciphers work on only a few bits at a time they have relatively low memory requirements (and therefore cheaper to implement in limited scenarios such as embedded devices, firmware, and esp. hardware).
  • Stream ciphers are more difficult to implement correctly, and prone to weaknesses based on usage - since the principles are similar to one-time pad, the keystream has very strict requirements. On the other hand, that's usually the tricky part, and can be offloaded to e.g. an external box.
  • Because block ciphers encrypt a whole block at a time (and furthermore have "feedback" modes which are most recommended), they are more susceptible to noise in transmission, that is if you mess up one part of the data, all the rest is probably unrecoverable. Whereas with stream ciphers bytes are individually encrypted with no connection to other chunks of data (in most ciphers/modes), and often have support for interruptions on the line.
  • Also, stream ciphers do not provide integrity protection or authentication, whereas some block ciphers (depending on mode) can provide integrity protection, in addition to confidentiality.
  • Because of all the above, stream ciphers are usually best for cases where the amount of data is either unknown, or continuous - such as network streams. Block ciphers, on the other hand, or more useful when the amount of data is pre-known - such as a file, data fields, or request/response protocols, such as HTTP where the length of the total message is known already at the beginning.
  • 6
    The 2nd bullet is not accurate. The difference in memory due to "carry over" from prior blocks is negligible and much smaller than the difference in memory from algorithm to algorithm (e.g., compare RC4, with its 256 bytes of internal state, to AES, with 0 bytes of internal state in some implmeentations). The last bullet draws false distinctions and is bad advice. – D.W. Jan 8 '11 at 0:45
  • 2
    @D.W. 2nd bullet was "generally speaking", as that is typically the case (but I accept that it is not strictly accurate). – AviD Jan 8 '11 at 23:31
  • @D.W. do you have any basis for your comment on the last bullet? Where is the false distinction, and why do you say this is bad advice? – AviD Jan 8 '11 at 23:32
  • 7
    yes, I have a basis for my comment on the last bullet. It just seems confused across the board. Block ciphers are fine for streaming data; see, e.g., CBC mode, CTR mode, etc., for various modes of operation that work fine with streaming data. Block ciphers are not restricted to cases where the amount of data is known in advance. I'm not aware of any reason to consider stream ciphers better than block ciphers for streaming data (despite the name). – D.W. Apr 3 '11 at 3:09
  • 7
    D.W. is correct: The word 'Stream' in Stream Cipher reflects that there is a keystream - a stream of bits that is combined with plaintext to produce the ciphertext. It does not not reflect the plaintext composition. Obviously this is a detail that often confuses developers and engineers with whom the latter is usually implied. Block ciphers can be used to manipulate streaming plaintext just fine. Also often confusing is that Block Ciphers can be used as a Stream Cipher with an appropriate mode of operation and when the block size is atomic (e.g. 1 byte). – Les Hazlewood Sep 29 '11 at 0:58

A block cipher is a versatile algorithm which implements a key-dependent permutation of values which are sequences of a fixed number of bits (called "blocks"). It can be used for various roles in many kinds of cryptographic protocols. One such role is bulk encryption of long streams of data; to achieve such a thing, the block cipher must be used with an appropriate mode of operation (aka "chaining mode"), the traditional one being CBC, and the trendy newer mode being CTR.

A stream cipher is a specialized algorithm for the purpose of bulk encryption of long streams of data. The idea is that, by forfeiting the versatility of the block cipher, it would be possible to create a more efficient algorithm (i.e. something which encrypts data faster).

Both block ciphers with a stream-oriented encryption mode, and stream ciphers, may run into security issues if the same key is used twice, for two distinct streams, without having an appropriate, unique/random enough Initialization Vector. For CBC encryption, the IV must be a new uniformly random sequence of bits, of the same size than a block, for each new message. Good stream ciphers also accept an IV. A traditional stream cipher called RC4 is IV-less (its specification does not state where or how an IV could be inserted), which led to much mayhem and gave a bad name to the concept of stream ciphers.

For newer, more secure (and faster) stream ciphers, see the eSTREAM portfolio. These algorithms have gone through a rather thorough analysis by many cryptographers and are considered "quite secure".

A stream cipher can be converted into a Pseudorandom Number Generator by encrypting a long sequence of bytes of value zero. Actually, many (but not all) stream ciphers internally work by being a PRNG, generating a long sequence of key-dependent pseudo-random bytes, which is subsequently combined (by bitwise XOR) with the data to encrypt (or decrypt), so encrypting zero bytes is then equivalent to omitting the XOR altogether. Therefore, stream ciphers are often used as custom PRNG.

  • You forgot to mention which is generally more secure (stream vs block). – trusktr Oct 22 '13 at 16:24
  • 11
    I did not forgot, because the assertion makes no general sense. Both block ciphers and stream ciphers can provide adequate security, if they are applied properly and don't have structural weaknesses. – Thomas Pornin Oct 22 '13 at 16:30
  • "the versatility of the block cipher" I have trouble with this part. What makes a block cipher inherently more versatile? Block ciphers can be used to encrypt and authenticate either both streams (e.g. TLS) or packetized data (e.g. ESP) and same for stream ciphers (e.g. TLS or DTLS). There are cases where a stream cipher seems more "natural" (e.g. encrypting audio) or a block cipher seems more "natural" (e.g. encrypting disks) but I just don't see a lot of gap in reasonable applications for either. – Dan Lenski Jul 22 '18 at 17:54

One advantage of stream ciphers that haven't been mentioned previously is that they don't need padding (block ciphers operates on complete blocks, so if you don't have enough data you must generate some more somehow). And surprise (not really, cryptography is the field where Murphy's everywhere), padding can be done wrong, as exemplified for example in Practical Padding Oracle Attacks.

Also security of block ciphers pretty much depend on their mode of operation, you still see ECB used here and there at times and it's not much better than no crypto at all.

Basically you can't say one is better than the other, one got to look at a complete cryptosystem to make a security judgement.

  • 2
    on your first paragraph: there are modes of operation for block ciphers that don't need padding, either: e.g., CTR mode. So this is not an advantage that is unique to stream ciphers. But +1 to your last paragraph -- well said! – D.W. Apr 3 '11 at 3:17
  • 1
    Well I'd say CTR and OFB are constructions to make a stream cipher from a block cipher. That's another great thing with block ciphers, they can easily be used as building blocks for other things, be it stream ciphers or one way hashes. Stream ciphers are not that versatile. – Bruno Rohée Apr 3 '11 at 5:38
  • You forgot to mention which is generally more secure (stream vs block). – trusktr Oct 22 '13 at 16:24
  • 2
    None is more secure by nature, it's really how you use them. – Bruno Rohée Oct 23 '13 at 13:45

Stream Ciphers crypts the plaintext data with a random stream of bit (usually with a XOR because it can be reversed easily). If you have a 128bit data, you will use a 128 bit psedurandom strem (your key) to encrypt.

Block Ciphers crypts the plain text data a block at a time with the same transformation (based on the key). So you have your 128bit data, the cipher breaks it in blocks (like 4 block of 32 bits) and apply the same transformation to every block obtaining 4 encrypted blocks, that combined will form the final cryptogram.

Of course because of this Block Cyphers are safer but expensive to use in terms of hardware complexity involved. Stream Ciphers are faster and "cheap" but they can be susceptible to security problems if implemented incorrectly.

  • 2
    The last paragraph has a number of factual errors. Block ciphers are not safer in general, nor are they necessarily worse in hardware. Stream ciphers are not necessarily faster or cheaper. – D.W. Jan 8 '11 at 0:43
  • @D.W.: notwithstanding, stream ciphers are usually faster or cheaper than block ciphers, because that's the deal: a less versatile algorithm traded for improved performance. A stream cipher which happens to be slower and more expensive than AES/CTR just does not get used at all. – Thomas Pornin Jan 3 '12 at 14:07
  • You forgot to mention which is generally more secure (stream vs block). – trusktr Oct 22 '13 at 16:25

Data (the stuff to be encrypted) usually comes in streams. To encrypt it, we need to employ a stream cipher, that is, an encryption algorithm suitable for use on a stream of data. A stream is a sequence of bits (or bytes) of arbitrary, varying, or unspecified length.

The best ciphers we have invented so far are usually block ciphers. A block cipher is capable of encrypting a single fixed-sized block of data; and, by the evidence around us, apparently it is easier to build good block ciphers than stream ciphers.

Good news, though. By using a given block cipher in some particular patterns (a "mode of operation"), and with the aid of particular padding strategies, we can transform any block cipher into a stream cipher! That means we can use the better ciphers, which are block ciphers, to encrypt any data, the majority of which comes in streams.

  • 2
    the second sentence seems misleading. You can encrypt streaming data using a block cipher, by using any of a number of standard modes of operation: e.g., CBC mode, CTR mode, etc. AES-CBC is still a block cipher. In fact, almost every standard mode of operation for block ciphers already supports streaming data. Moreover, a block cipher is not secure without a mode of operation, so it's not like a mode of operation is some optional thing that you only need when you want to encrypt streaming data. – D.W. Apr 3 '11 at 3:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.