ChaCha20-Poly1305: Authenticated Stream Cipher Encryption
Fast, secure AEAD encryption standardized in RFC 8439
Introduction
ChaCha20-Poly1305 is an Authenticated Encryption with Associated Data (AEAD) cipher combining two primitives:
- ChaCha20 — a stream cipher by Daniel J. Bernstein providing confidentiality
- Poly1305 — a message authentication code (MAC) providing integrity and authenticity
It is standardized in RFC 8439 and is one of the two mandatory cipher suites in TLS 1.3 alongside AES-256-GCM.
ChaCha20-Poly1305 vs AES-256-GCM
| Property | ChaCha20-Poly1305 | AES-256-GCM |
|---|---|---|
| Speed (no HW AES) | Faster | Slower |
| Speed (with HW AES) | Slower | Faster |
| Side-channel resistance | Stronger (constant-time) | Requires hw support |
| Key size | 256-bit only | 128 / 192 / 256-bit |
| Nonce size | 96-bit | 96-bit |
| Authentication | Poly1305 (built-in) | GHASH (built-in) |
| Standard | RFC 8439 (2018) | NIST SP 800-38D |
| Used in | TLS 1.3, WireGuard, Android, SSH | TLS 1.3, HTTPS, disk encryption |
How ChaCha20 works
ChaCha20 generates a keystream from the key and nonce using a quarter-round function applied 20 times:
State = [constants(4) | key(8) | counter(1) | nonce(3)] (16 x 32-bit words)
For i in 1..10:
QuarterRound(state) // column rounds
QuarterRound(state) // diagonal rounds
Keystream = state XOR initial_state
Ciphertext = Plaintext XOR KeystreamSecurity analysis
| Attack | Resistance |
|---|---|
| Brute-force key | 2^256 operations — infeasible classically |
| Quantum (Grover) | Reduces to 128-bit effective security — safe for long-term use |
| Nonce reuse | CRITICAL — reveals keystream. Never reuse key+nonce pair |
| Timing attacks | Designed to run in constant time — resistant |
| Forgery (Poly1305) | 2^-106 forgery probability — negligible |
Real-world usage
- TLS 1.3 — mandatory cipher suite (RFC 8446)
- WireGuard VPN — primary encryption algorithm
- Android — full disk encryption on devices without hardware AES
- OpenSSH — chacha20-poly1305@openssh.com cipher
- Signal Protocol — message encryption
- QUIC / HTTP3 — transport layer encryption
References
- RFC 8439 — ChaCha20 and Poly1305 for IETF Protocols
- D. J. Bernstein, "ChaCha, a variant of Salsa20" (2008)
- RFC 8446 — TLS 1.3