Pretty much everybody uses this for encryption; the most popular stream cipher (qua stream cipher) in the world is Salsa20/ChaCha20, which is simply a keyed hash function run in counter mode.

> ...structure-preserving pseudonymization

Can you write about this a bit more, please (what does it mean)? Is it comparable to Tokenization (typically used to hide sensitive-date like credit card details, for example) [0], or to Homomorphic encryption [1]?

[0] https://en.wikipedia.org/wiki/Tokenization_(data_security)

[1] https://people.csail.mit.edu/vinodv/FHE/FHE-refs.html

Tokenization typically means that a third party keeps an association table, though it is possible to generate tokens cryptographically. Homomorphic encryption is something different again, though you could call this structure-preserving pseudonymization homomorphic as it preserves certain structural properties of the input data. It does not provide the same security guarantees as FHE though as the structure preservation weakens the encryption. For pseudonymization this is a tradeoff that can be worthwhile though.

> (to my knowledge) no standardized stream cipher that provides output feedback mode (OFB) out-of-the-box.

I wasn't aware stream ciphers typically had different modes of operation like block ciphers did. Could you expand on this? I'm kind of interested.

OFB means you feed the output of the cipher back to the input. Hence if you have two character sequences that share a prefix e.g. "abc123" and "abcxyz" the first three cipher stream bits will be identical and then deviate based on the feedback the cipher gets (assuming no IV and identical key). This is interesting for pseudonymization when you want to e.g. create cryptographically secure pseudonyms that preserve prefixes (think IP address pseudonyms that preserve subnet groupings).