ChaCha20

ChaCha20 is a stream cipher designed by Daniel J. Bernstein as a refinement of Salsa20, released in 2008. It is designed for efficiency on 32-bit architectures and for resistance to timing side channels. ChaCha20 is widely used as the encryption primitive in modern secure communication protocols, often in conjunction with Poly1305 for authentication.

ChaCha20 operates on 32-bit words and uses a 256-bit key, a 96-bit nonce, and a 32-bit block counter. The cipher maintains a 16-word state consisting of four constant words, the key (eight words), the counter, and the nonce. It applies a sequence of 20 rounds of a quarter-round function to this state. After the rounds, the original state is added to the transformed state to form a keystream block, which is then XORed with the plaintext to produce ciphertext. Each keystream block encrypts 64 bytes; the counter is incremented for each block, and the nonce remains fixed for a given key.

There are variants with fewer rounds, such as ChaCha20-12 and ChaCha20-8, offering different performance and security tradeoffs. A related construction, XChaCha20, extends the nonce to 192 bits for longer stream lifetimes. The ChaCha family is designed to be simple to implement efficiently and to enable constant-time operation to avoid timing leaks.

ChaCha20 is commonly used in authenticated encryption with associated data via ChaCha20-Poly1305 (the AEAD construction). This combination provides confidentiality and integrity and is standardized in TLS, TLS 1.3, IPsec, and various cryptographic libraries such as OpenSSL and libsodium.

While considered secure and fast, ChaCha20 requires unique nonces per key; nonce reuse can completely compromise security by keystream reuse. As with any cipher, proper key management and nonce handling are essential.