# What Is ChaCha20-Poly1305? Definition and Examples

> ChaCha20-Poly1305 is an AEAD cipher pairing the ChaCha20 stream cipher with the Poly1305 authenticator, designed to be fast and constant-time in pure software.

Source: https://ssl.sh/glossary/chacha20-poly1305/
Last updated: 2026-11-10

ChaCha20-Poly1305 is an [AEAD](https://ssl.sh/glossary/aead/) algorithm built from two primitives designed by Daniel J. Bernstein: the ChaCha20 stream cipher for encryption and the Poly1305 one-time authenticator for the tag. The IETF variant, specified in [RFC 8439](https://www.rfc-editor.org/rfc/rfc8439), uses a 256-bit key, a 96-bit nonce and a 128-bit tag. RFC 7905 defines TLS 1.2 suites such as ECDHE-RSA-CHACHA20-POLY1305, and [TLS 1.3](https://ssl.sh/glossary/tls-1-3/) includes TLS_CHACHA20_POLY1305_SHA256.

## Why it matters
ChaCha20 uses only additions, rotations and XORs, so it runs quickly and without secret-dependent memory access on processors that lack AES instructions, such as older or low-end phones and small ARM boards. On those devices it is typically much faster than software AES. It also gives TLS a second, structurally different AEAD cipher, so the ecosystem does not depend solely on [AES-GCM](https://ssl.sh/glossary/aes-gcm/). Servers that enable both usually let the client choose, so each device can pick whichever cipher its hardware handles best.

## Example
Force a TLS 1.3 connection that uses ChaCha20-Poly1305, to confirm the server supports it:

```bash
openssl s_client -connect example.com:443 -tls1_3 -ciphersuites TLS_CHACHA20_POLY1305_SHA256
```

For TLS 1.2 in nginx, include ECDHE-ECDSA-CHACHA20-POLY1305 and ECDHE-RSA-CHACHA20-POLY1305 in `ssl_ciphers`.

## Common misconceptions
- **"It is weaker than AES because it is a stream cipher."** RC4's failures were specific to RC4. ChaCha20 has a 256-bit key, no known practical attacks, and is an IETF standard.
- **"It is always faster than AES-GCM."** On CPUs with AES hardware acceleration, AES-GCM is usually as fast or faster; ChaCha20's advantage is on hardware without it.
- **"It needs a particular certificate type."** The bulk cipher is independent of whether the certificate uses RSA or ECDSA.

## Related terms

- [AEAD](https://ssl.sh/zh/glossary/aead/): AEAD 是带关联数据的认证加密算法，一次运算同时完成数据加密和完整性认证，并能保护不加密的附加数据不被篡改。
- [AES-GCM](https://ssl.sh/zh/glossary/aes-gcm/): AES-GCM 是以伽罗瓦/计数器模式运行的 AES 分组密码，属于 AEAD 算法，用计数器模式加密、用 GHASH 认证标签保证完整性。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [TLS 1.2](https://ssl.sh/zh/glossary/tls-1-2/): TLS 1.2 是 2008 年由 RFC 5246 定义的 TLS 版本，引入了基于 SHA-256 的密钥派生和 AES-GCM 等 AEAD 加密算法，至今仍被广泛使用。
- [RC4](https://ssl.sh/zh/glossary/rc4/): RC4 是 Ron Rivest 在 1987 年设计的流密码，曾在 SSL/TLS 中广泛使用，因密钥流存在统计偏差，2015 年被 RFC 7465 禁止用于 TLS。