Authenticated encryption mode for stream cipher? Block ciphers have modes like GCM or OCB that combine primitives to provide both authentication and encryption.

Are there similar constructs for stream ciphers, which provide both authentication and encryption using only one cryptographic primitive - actual stream cipher (or keystream)?
An OCB like mode seems impossible with stream-ciphers. It's coupled tightly to the concept of a keyed permutation i.e. a (tweakable) block-cipher.

Many authenticated encryption actually combine two distinct primitives. It's just that the specification and API only expose the combination.

Essentially these xor a key-stream into the message to encrypt it (i.e. they use a synchronous stream cipher), and then authenticate the ciphertext using a MAC. Often they use part of the key-stream as one-time keys for the MAC.


AES-GCM is built by combining a polynomial one-time MAC called GHash with the stream cipher AES-CTR.

While AES itself is a block cipher, AES-CTR behaves like a stream cipher. GCM doesn't use AES in a way that'd prevent the use of a stream cipher.
Salsa20-Poly1305 is built by combining a polynomial one-time MAC called Poly1305 with the stream cipher Salsa.
Poly1305-AES is built by combining a polynomial one-time MAC called Poly1305 with the stream cipher AES-CTR.


Then there are some stream ciphers which provide authentication without a separate primitive. These constructions aren't synchronous stream ciphers, and can't be used together with a one-time-pad or plain key-stream.


Helix and Phelix are authenticated stream ciphers that merge authentication and encryption. There has been some criticism of their security, but I'm not sure if that criticism is actually valid.
Keccak (built on an unkeyed permutation) using the duplex constructio can considered an authenticated stream cipher