ChaCha20-Poly1305

In short: ChaCha20-Poly1305 is a modern encryption mode that encrypts data and checks for tampering at once. It is especially fast on devices without AES hardware acceleration.

In more detail: ChaCha20 is a stream cipher, Poly1305 a message authentication code. Together they form an AEAD scheme and, alongside AES-GCM, are standard in TLS 1.3, WireGuard and SSH.

In Depth

• ChaCha20: From a key (256 bits), nonce (96 bits) and counter it produces a keystream that is XORed onto the data. It consists only of addition, rotation and XOR, so it runs in constant time without lookup tables. That hampers timing attacks.
• Poly1305: From a one-time key it computes a 16-byte tag over the data. If it does not verify on decryption, the data is rejected.
• Advantage: On older phones and small devices without AES instructions often much faster than AES-GCM.
• Important: The nonce must never repeat under the same key.
• Origin: Designed by Daniel J. Bernstein.

See also: AES modes of operation