sodium_crypto_stream generates a specified number of pseudorandom keystream bytes from a nonce and key; provides no message authentication.
The examples explain the data format, expected results and the difference between this API and nearby cryptographic operations.
What It Does
The operation is intended for: sodium_crypto_stream generates a specified number of pseudorandom keystream bytes from a nonce and key; provides no message authentication.
The sodium extension must be enabled.
Syntax and Return Value
sodium_crypto_stream(int $length, string $nonce, string $key): string| Parameter | Purpose |
|---|---|
| $length (int) | Requested output length; consult byte-versus-text units for the chosen API. |
| $nonce (string) | A fixed-length per-message nonce; the uniqueness rule is essential to security. |
| $key (string) | Raw key bytes in the required algorithm-specific length; protect them from disclosure. |
The declared return type is shown above. Errors can include false results or exceptions depending on this API: A raw stream cipher does not provide authentication. For application encryption use secretbox or an AEAD function.
Example 1: Basic Operation
A stream has no authentication; prefer secretbox or AEAD for complete application encryption.
<?php
$key = random_bytes(SODIUM_CRYPTO_STREAM_KEYBYTES);
$nonce = random_bytes(SODIUM_CRYPTO_STREAM_NONCEBYTES);
$stream = sodium_crypto_stream(16, $nonce, $key);
echo strlen($stream);Example 2: A Different Use Case
A stream has no authentication; prefer secretbox or AEAD for complete application encryption.
<?php
// Check the alternative case.
$key = random_bytes(SODIUM_CRYPTO_STREAM_KEYBYTES);
$nonce = random_bytes(SODIUM_CRYPTO_STREAM_NONCEBYTES);
$stream = sodium_crypto_stream(24, $nonce, $key);
echo strlen($stream);Practical Example: Checking the Result
A stream has no authentication; prefer secretbox or AEAD for complete application encryption.
<?php
// Verify the expected behavior before using results.
$key = random_bytes(SODIUM_CRYPTO_STREAM_KEYBYTES);
$nonce = random_bytes(SODIUM_CRYPTO_STREAM_NONCEBYTES);
$stream = sodium_crypto_stream(32, $nonce, $key);
echo strlen($stream);Important Behavior and Edge Cases
A raw stream cipher does not provide authentication. For application encryption use secretbox or an AEAD function.
A raw stream cipher does not provide authentication. For application encryption use secretbox or an AEAD function.
Comparison with Related Functions
| Approach | Key distinction |
|---|---|
| sodium_crypto_stream | sodium_crypto_stream generates a specified number of pseudorandom keystream bytes from a nonce and key; provides no message authentication. |
| Related technique | sodium_crypto_secretbox combines encryption with authentication. |
Common Beginner Mistakes
| Mistake | Correct approach |
|---|---|
| Confusing this operation with a neighboring cryptographic or security mechanism | sodium_crypto_secretbox combines encryption with authentication. |
| Ignoring a security prerequisite or failure case | A raw stream cipher does not provide authentication. For application encryption use secretbox or an AEAD function. |
Key Takeaways
- sodium_crypto_stream generates a specified number of pseudorandom keystream bytes from a nonce and key; provides no message authentication.
- A raw stream cipher does not provide authentication. For application encryption use secretbox or an AEAD function.
- sodium_crypto_secretbox combines encryption with authentication.
Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.