ChaCha20-Poly1305

ChaCha20-Poly1305 is an AEAD algorithm built from two primitives designed by Daniel J. Bernstein: the ChaCha20 stream cipher for encryption and the Poly1305 one-time authenticator for the tag. The IETF variant, specified in RFC 8439, uses a 256-bit key, a 96-bit nonce and a 128-bit tag. RFC 7905 defines TLS 1.2 suites such as ECDHE-RSA-CHACHA20-POLY1305, and TLS 1.3 includes TLS_CHACHA20_POLY1305_SHA256.

Why it matters

ChaCha20 uses only additions, rotations and XORs, so it runs quickly and without secret-dependent memory access on processors that lack AES instructions, such as older or low-end phones and small ARM boards. On those devices it is typically much faster than software AES. It also gives TLS a second, structurally different AEAD cipher, so the ecosystem does not depend solely on AES-GCM. Servers that enable both usually let the client choose, so each device can pick whichever cipher its hardware handles best.

Example

Force a TLS 1.3 connection that uses ChaCha20-Poly1305, to confirm the server supports it:

openssl s_client -connect example.com:443 -tls1_3 -ciphersuites TLS_CHACHA20_POLY1305_SHA256

For TLS 1.2 in nginx, include ECDHE-ECDSA-CHACHA20-POLY1305 and ECDHE-RSA-CHACHA20-POLY1305 in ssl_ciphers.

Common misconceptions

• "It is weaker than AES because it is a stream cipher." RC4's failures were specific to RC4. ChaCha20 has a 256-bit key, no known practical attacks, and is an IETF standard.
• "It is always faster than AES-GCM." On CPUs with AES hardware acceleration, AES-GCM is usually as fast or faster; ChaCha20's advantage is on hardware without it.
• "It needs a particular certificate type." The bulk cipher is independent of whether the certificate uses RSA or ECDSA.