Block Cipher vs Stream Cipher in Web Application I'm doing research about "Cryptographic attack methods in Web Application" so I have some questions to ask you guys:


Block Cipher vs Stream Cipher, which is more common used in Web Application?
How and Where is Stream Cipher implemented in Web Application?


Hope to get your response soon :)
Very few cryptosystems actually use a block cipher directly (i.e. in "ECB mode") to encrypt data &mdash; and those that do usually only do so because whoever designed them didn't really understand how a block cipher should be used.

Rather, the main use of block ciphers in cryptography is as versatile building blocks for other cryptographic components, such as stream ciphers, message authentication codes, hash functions, KDFs etc.  In particular, the usual way to use a block cipher to encrypt free-form data is by using a mode of operation such as CBC, CFB, OFB or CTR (or an authenticated mode like EAX, GCM, OCB or SIV) which actually uses the block cipher to construct a kind of stream cipher.

Thus, the actual distinction, insofar as there is one, is not between block ciphers and stream ciphers as such, but between stream ciphers based on block ciphers (like AES-CTR or AES-CBC) and "primitive" stream ciphers not based on block ciphers (of which the most common is probably RC4).

I don't really have any reliable statistics on how much those are respectively used in web applications, but my gut feeling would be that the majority (say, 95%) of (symmetric) encryption schemes used in such systems are probably based on block ciphers (mostly AES, some 3DES, occasionally rarer types like Serpent, Blowfish or old single DES).  Their main competitor is RC4, with a small but non-negligible share (say, 5%), while all other "primitive" stream ciphers (like the eSTREAM ciphers) are probably marginal (&lt;&nbsp;1%), mostly because few crypto libraries support them.

(The share of RC4 probably goes up a bit if its use in SSL / TLS is included in the total, particularly since many websites switched to it after the BEAST attack exposed weaknesses in the TLS 1.0 implementation of AES-CBC.)