Converting a stream cipher into a block cipher The well-known Counter-Mode (CTR) mode of operation for a block cipher essentially converts any block cipher into a stream cipher.  Is there a way to do the reverse?  In other words, given a "good" stream cipher $G$, can we construct a block cipher that builds its strength based on $G$?
In an answer to another question, Zooko mentioned the BEAR and LION constructions,  linking to this paper: Two Practical and Provable Secure Block Ciphers: BEAR and LION.

These build a block cipher (with large blocks) from a stream cipher and a hash function (a keyed one (i.e. a MAC) for BEAR, a unkeyed one for LION).

The authors basically build block ciphers (with variable block sizes $m$) from a keyed hash function (a function family $H_K : \{0,1\}^* \to \{0,1\}^k$) or a normal hash (a function $H' \{0,1\}^* \to \{0,1\}^k$) and a stream cipher (a function $S : \{0,1\}^k \to \{0,1\}^n$, for arbitrary $n$ from context; here $n = m-k$).

These work by fist splitting the input block of size $m$ in two parts, one (L) of size $k$ and one (R) of size $m-k$, doing the encryption/decryption, and putting the two parts again together. We also have two keys $K_1$ and $K_2$, each of length $k$.

For BEAR, the encryption is done by

$$  L := L ⊕ H_{K_1}(R) $$
  $$  R := R ⊕ S(L)  $$
  $$  L := L ⊕ H_{K_2}(R) $$

and decryption the other way around:

$$  L := L ⊕ H_{K_2}(R) $$
  $$  R := R ⊕ S(L) $$
  $$  L := L ⊕ H_{K_1}(R) $$

For LION, we use a un-keyed hash function $H'$, and we have two calls of the stream cipher instead of the hash function instead of two keyed hash calls. Encryption:

$$  R := R ⊕ S(L ⊕ K_1) $$
  $$  L := L ⊕ H'(R) $$
  $$  R := R ⊕ S(L ⊕ K_2) $$

Decryption:

$$  R := R ⊕ S(L ⊕ K_2) $$
  $$  L := L ⊕ H'(R) $$
  $$  R := R ⊕ S(L ⊕ K_1) $$

E.g. decryption is in both cases just encryption with swapped key halves.

These are effectively Feistel networks with three asymmetric rounds.

The paper proves that these are secure (against certain attacks) as long as even one of the component functions is secure (e.g. breaking the composed primitive allows breaking both of the components).

There is a third construction mentioned in this paper, LIONESS, which uses four rounds (two keyed hashes, two stream cipher calls), which also provides resistance against an adaptive combined chosen plaintext and ciphertext attack.