ChaCha20-Poly1305

Edit links
Source: Wikipedia, the free encyclopedia.

ChaCha20-Poly1305 is an authenticated encryption with additional data (AEAD) algorithm, that combines the ChaCha20 stream cipher with the Poly1305 message authentication code. Its usage in IETF protocols is standardized in RFC 8439.[1] It has fast software performance, and without hardware acceleration, is usually faster than AES-GCM.[2]

History

The two building blocks of the construction, the algorithms Poly1305 and ChaCha20, were both independently designed, in 2005 and 2008, by Daniel J. Bernstein.[3][4]

In 2013–2014, a variant of the original ChaCha20 algorithm (using 32-bit counter and 96-bit nonce) and a variant of the original Poly1305 (authenticating 2 strings) were combined in an IETF draft[5][6] to be used in TLS and DTLS,[7] and chosen by Google, for security and performance reasons, as a newly supported cipher.[8] Shortly after Google's adoption for TLS, ChaCha20, Poly1305 and the combined AEAD mode are added to OpenSSH via the[email protected] authenticated encryption cipher[9][10] but kept the original 64-bit counter and 64-bit nonce for the ChaCha20 algorithm.

In 2015, the AEAD algorithm is standardized in RFC 7539[11] and RFC 7905[12] to be used in TLS 1.2 and DTLS 1.2 and in RFC 7634[13] to be used in IPsec. The same year, it was integrated by Cloudflare as an alternative ciphersuite.[14]

In June 2018, the RFC 7539 was updated and replaced by RFC 8439.[1]

Description

The ChaCha20-Poly1305 algorithm as described in RFC 8439[1] takes as input a 256-bit key and a 96-bit nonce to encrypt a plaintext, with a ciphertext expansion of 128-bit (the tag size). In the ChaCha20-Poly1305 construction, ChaCha20 is used in counter mode to derive a key stream that is XORed with the plaintext. The ciphertext and the associated data is then authenticated using a variant of Poly1305 that first encodes the two strings into one. The way that a cipher and a one time authenticator are combined is precisely identical to AES-GCM construction in how the first block is used to seed the authenticator and how the ciphertext is then authenticated with a 16-byte tag.

The main external difference with ChaCha20 is its 64 byte (512 bit) block size, in comparison to 16 bytes (128 bit) with both AES-128 and AES-256. The larger block size enables higher performance on modern CPUs and allows for larger streams before the 32 bit counter overflows.

ChaCha20-Poly1305 Encryption
ChaCha20-Poly1305 Encryption

Variants

XChaCha20-Poly1305 – extended nonce variant

The XChaCha20-Poly1305 construction is an extended 192-bit nonce variant of the ChaCha20-Poly1305 construction, using XChaCha20 instead of ChaCha20. When choosing nonces at random, the XChaCha20-Poly1305 construction allows for better security than the original construction. The draft attempt to standardize the construction expired in July 2020.[15]

Salsa20-Poly1305 and XSalsa20-Poly1305

Salsa20-Poly1305 and XSalsa20-Poly1305 are variants of the ChaCha20-Poly1305 and XChaCha20-Poly1305 algorithms, using Salsa20 and XSalsa20 in place of ChaCha20 and XChaCha20. They are implemented in NaCl[16] and libsodium[17] but not standardized. The variants using ChaCha are preferred in practice as they provide better diffusion per round than Salsa.[3]

Reduced-round variants

ChaCha20 can be replaced with its reduced-round variants ChaCha12 and ChaCha8, yielding ChaCha12-Poly1305 and ChaCha8-Poly1305. The same modification can be applied to XChaCha20-Poly1305. These are implemented by the RustCrypto team and not standardized.[18]

Use

ChaCha20-Poly1305 is used in

libsodium
.

Performance

ChaCha20-Poly1305 usually offers better performance than the more prevalent

ARM
-based CPUs. Because ChaCha20-Poly1305 has less overhead than AES-GCM, so use ChaCha20-Poly1305 on mobile devices may consume less power than AES-GCM.

Security

The ChaCha20-Poly1305 construction is generally secure in the

timing attacks
.

However, ChaCha20-Poly1305 is one of the algorithms vulnerable to the Terrapin attack.

See also

External links

  • RFC 8439: ChaCha20 and Poly1305 for IETF Protocols
  • RFC 7634: ChaCha20, Poly1305, and Their Use in the Internet Key Exchange Protocol (IKE) and IPsec
  • RFC 7905: ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS)
  • RFC 8103: Using ChaCha20-Poly1305 Authenticated Encryption in the Cryptographic Message Syntax (CMS)

References

  1. ^
    doi:10.17487/RFC8439. RFC 8439
    .
  2. ^
    doi:10.17487/RFC8439. RFC 8439
    .
  3. ^ a b Bernstein, D. J. (January 2008). ChaCha, a variant of Salsa20 (PDF). The State of the Art of Stream Ciphers. Vol. 8. pp. 3–5.
  4. ISBN 978-3-540-26541-2
  5. ^ Langley, Adam (September 2013). ChaCha20 and Poly1305 based Cipher Suites for TLS. I-D draft-agl-tls-chacha20poly1305-00.
  6. ^ Nir, Yoav (27 January 2014). ChaCha20 and Poly1305 for IETF protocols. I-D draft-nir-cfrg-chacha20-poly1305-00.
  7. ^ Langley, Adam; Chang, Wan-Teh; Mavrogiannopoulos, Nikos; Strombergson, Joachim; Josefsson, Simon (24 January 2014). The ChaCha Stream Cipher for Transport Layer Security. I-D draft-mavrogiannopoulos-chacha-tls-01.
  8. ^ Bursztein, Elie (24 April 2014). "Speeding up and strengthening HTTPS connections for Chrome on Android". Google Online Security Blog. Archived from the original on 2016-09-28. Retrieved 2021-12-27.
  9. ^ Miller, Damien. "Super User's BSD Cross Reference: /OpenBSD/usr.bin/ssh/PROTOCOL.chacha20poly1305". bxr.su. Archived from the original on 2013-12-13. Retrieved 2021-12-28.
  10. ^ Miller, Damien (29 November 2013). "ChaCha20 and Poly1305 in OpenSSH". Archived from the original on 2013-12-13. Retrieved 2021-12-28.
  11. doi:10.17487/RFC7539. RFC 7539
    .
  12. ^
    doi:10.17487/RFC7905. RFC 7905
    .
  13. doi:10.17487/RFC7634. RFC 7634
    .
  14. ^ "Do the ChaCha: better mobile performance with cryptography". The Cloudflare Blog. 2015-02-23. Retrieved 2021-12-28.
  15. ^ Arciszewski, Scott (10 January 2020). XChaCha: eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305. I-D draft-irtf-cfrg-xchacha.
  16. ^ "NaCl: Networking and Cryptography library - Secret-key authenticated encryption". Archived from the original on 2009-06-30.
  17. ^ "libsodium - Authenticated encryption". Archived from the original on 2020-08-04.
  18. ^ "chacha20poly1305 - Rust". docs.rs. ChaCha8Poly1305 / ChaCha12Poly1305 - non-standard, reduced-round variants (gated under the reduced-round Cargo feature). See the Too Much Crypto paper for background and rationale on when these constructions could be used. When in doubt, prefer ChaCha20Poly1305. XChaCha8Poly1305 / XChaCha12Poly1305 - same as above, but with an extended 192-bit (24-byte) nonce.
  19. ^
    doi:10.17487/RFC9001. RFC 9001
    .
  20. ^ Donenfeld, Jason A. "Protocol & Cryptography - WireGuard". www.wireguard.com. Retrieved 2021-12-28.
  21. doi:10.17487/RFC8103. RFC 8103
    .
  22. ^ OTRv4, OTRv4, 2021-12-25, retrieved 2021-12-28
  23. ^ borg rcreate, borgbackup, 2022-08-03, retrieved 2023-01-28
  24. S2CID 244077782
    , retrieved 2021-12-27
Retrieved from "https://en.wikipedia.org/w/index.php?title=ChaCha20-Poly1305&oldid=1221152294"