Stream Ciphers vs. Block Ciphers: What's the Difference?

A block cipher encrypts data in fixed-size chunks. A stream cipher encrypts one byte at a time. The difference sounds small. It changes everything from padding requirements to error propagation to how catastrophically things fail when you misuse a nonce.

Every encrypted connection you make today uses one of these two families. AES in GCM mode (a block cipher turned into a stream cipher) protects most HTTPS traffic. ChaCha20-Poly1305 (a dedicated stream cipher) protects the rest. The block cipher tool lets you experiment with AES and DES in different modes to see the differences firsthand.

A stream cipher generates a pseudorandom keystream from a secret key and a nonce. The keystream is XORed with the plaintext byte by byte to produce ciphertext. Decryption is identical: XOR the ciphertext with the same keystream.

`` keystream = PRF(key, nonce) ciphertext = plaintext XOR keystream plaintext = ciphertext XOR keystream ``

The XOR operation is its own inverse. If you XOR the same keystream with the ciphertext, you get back the plaintext. No padding is needed because the keystream is exactly as long as the message. The cipher processes data one byte at a time, which means it can handle arbitrary-length inputs without block alignment.

This is the same principle behind the Vernam cipher, which uses a truly random key instead of a pseudorandom keystream. The difference is that a stream cipher generates its keystream from a short key, while the Vernam cipher requires a key as long as the message.

The critical rule: never reuse a nonce with the same key. If you encrypt two messages with the same keystream, XORing the two ciphertexts cancels out the keystream and leaves you with the XOR of the two plaintexts. That is a two-time pad, and it leaks information immediately.

A block cipher encrypts fixed-size blocks of data. AES operates on 128-bit (16-byte) blocks. The cipher transforms an entire block at once using multiple rounds of substitution and permutation. AES-128 uses 10 rounds, AES-256 uses 14.

Each round consists of four operations: SubBytes (substitution using an S-box), ShiftRows (byte permutation), MixColumns (diffusion across columns), and AddRoundKey (XOR with a round key derived from the main key). These operations implement Claude Shannon's principles of confusion (making the relationship between key and ciphertext complex) and diffusion (spreading the influence of each plaintext bit across the ciphertext).

Because block ciphers process fixed-size blocks, they need padding when the plaintext is not a multiple of the block size. PKCS#7 padding appends bytes whose value equals the number of padding bytes added. If the plaintext is already block-aligned, a full block of padding is appended so the decoder can distinguish padding from real data.

Block ciphers also need a mode of operation to handle messages longer than one block. ECB (Electronic Codebook) encrypts each block independently, which leaks patterns. CBC (Cipher Block Chaining) XORs each plaintext block with the previous ciphertext block. CTR (Counter) mode turns a block cipher into a stream cipher by encrypting a counter and XORing the result with plaintext. GCM (Galois/Counter Mode) adds authenticated encryption on top of CTR. You can test all of these with the AES block cipher tool.

Padding and block alignment: Stream ciphers need no padding. Block ciphers in ECB and CBC modes require padding, which introduces padding oracle attacks if the implementation leaks whether padding is valid. CTR and GCM modes avoid padding by turning the block cipher into a stream cipher.

Error propagation: In CBC mode, a single bit flip in a ciphertext block corrupts the corresponding plaintext block entirely and flips one bit in the next block. In a stream cipher, a single bit flip in the ciphertext flips exactly one bit in the plaintext. This makes stream ciphers vulnerable to bit-flipping attacks unless authenticated encryption (like Poly1305 or GCM's GMAC) is used.

Nonce reuse consequences: Reusing a nonce in a stream cipher is catastrophic. AES-GCM with a reused nonce leaks the XOR of two plaintexts and exposes the authentication key, allowing forgery. Reusing an IV in CBC mode is less severe but still leaks prefix information. The RC4 cipher was broken partly because its keystream has statistical biases that leak plaintext across many sessions, even without nonce reuse.

Performance: Stream ciphers like ChaCha20 are faster than AES on devices without hardware AES acceleration (most mobile devices and IoT hardware before 2015). On modern x86 processors with AES-NI instructions, AES-GCM is faster. This is why TLS negotiates both: AES-GCM for desktops, ChaCha20-Poly1305 for mobile.

TLS 1.3: The current TLS standard (RFC 9846, published July 2026) offers five cipher suites, all AEAD. Three use AES-GCM (AES-128-GCM and AES-256-GCM with SHA-256 or SHA-384), and two use ChaCha20-Poly1305. There is no CBC, no RC4, no non-AEAD option. The protocol treats AES-GCM as a stream cipher (CTR mode internally) and ChaCha20 as a dedicated stream cipher. Both provide confidentiality and integrity in a single operation.

Signal protocol: Signal uses AES-GCM for message encryption on most platforms. On older Android devices without AES-NI, it falls back to ChaCha20-Poly1305. The choice is made per-device based on benchmark results.

Disk encryption: Full-disk encryption uses XTS mode (XEX-based Tweaked-codebook mode with ciphertext Stealing), which is a block cipher mode designed for sector-level encryption. XTS is not a stream cipher mode because it preserves the block structure needed for random access to disk sectors. You cannot use a stream cipher for disk encryption because modifying one byte would require re-encrypting everything after it.

CTF challenges: CryptoCTF and picoCTF often include stream cipher challenges where the vulnerability is nonce reuse. The attack is always the same: XOR the two ciphertexts to cancel the keystream, then use crib dragging (trying common words like "the ", "flag{", "http") to recover both plaintexts.

The distinction between stream and block ciphers is blurrier than it looks. AES-GCM is a block cipher used in CTR mode, which makes it functionally a stream cipher. ChaCha20 is a dedicated stream cipher used with Poly1305 for authentication, which makes it functionally an AEAD construction. The practical question is not "stream or block" but "does the mode provide authenticated encryption, and does the implementation handle nonces correctly?"

AES-GCM has a hard limit on how much data can be encrypted under a single key-nonce pair: 2^39 - 256 bits (about 64 GB). Exceeding this limit causes nonce reuse within the counter space, which breaks security. ChaCha20-Poly1305 has a higher limit but is still bounded by the 96-bit nonce space. For long-lived sessions, both require key rotation.

The encoding vs. encryption vs. hashing post covers the broader distinction between these operations, which is a common source of confusion for developers new to cryptography.