ChaCha20-Poly1305

As explained in Real-World Cryptography

ChaCha20-Poly1305 is an authenticated-encryption-with-associated-data construction combining the ChaCha20 stream cipher with the Poly1305 message authentication code.

ChaCha20-Poly1305 is an authenticated-encryption construction that combines ChaCha20, a stream cipher, with Poly1305, a message authentication code. It hides plaintext and detects tampering with ciphertext or associated data. section 4.5.3

Its main flow is:

• ChaCha20 uses a 256-bit key, a 12-byte nonce, and a counter to generate a keystream. section 4.5.3
• XORing the keystream with plaintext produces ciphertext; repeating the operation with ciphertext recovers plaintext. section 4.5.3
• Poly1305 authenticates the ciphertext and associated data, using keys derived through ChaCha20. section 4.5.3

The nonce warning

Never reuse a nonce with the same key: reuse exposes the XOR of two plaintexts and can break authentication. Widely adopted protocols include OpenSSH, TLS, and Noise. section 4.5.3 section 4.7

Figure 4.23 ChaCha20-Poly1305 works by using ChaCha20 to encrypt the plaintext and to derive the keys required by the Poly1305 MAC. Poly1305 is then used to authenticate the ciphertext as well as the associated data.

A diagram connects ChaCha20 encryption and key derivation with Poly1305 authentication of ciphertext and associated data. section 4.5.3

How Real-World Cryptography covers it

How deep it goes

Explains parameters, keystream blocks, XOR processing, Poly1305 accumulation, and combined authentication, without formal proofs.

Examples

Uses keystream XOR flows, internal block-function diagrams, Poly1305 accumulation, and adoption in OpenSSH, TLS, Noise, and Android.

What it assumes

Assumes familiarity with symmetric keys, plaintext, ciphertext, nonces, and message authentication codes.

What you can do after

Evaluate/understand how to use an AEAD for shared-key communication while avoiding nonce reuse.

How it connects

Connects stream ciphers, message authentication codes, AEAD, associated data, nonces, AES-GCM, and AES-CTR.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• ChaChauses · ChaCha20 is a stream cipher that generates a pseudorandom keystream from a key, nonce, and counter using an ARX quarter-round design.
• Poly1305uses · Poly1305 is a message authentication code that authenticates data using polynomial arithmetic modulo a fixed constant and a one-time authentication key.
• authenticated encryption with associated datakind of · Authenticated encryption with associated data is a cryptographic construction that encrypts plaintext while authenticating the ciphertext and optional unencrypted associated data.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.