Poly1305

Poly1305 is a message authentication code (MAC) designed by Daniel J. Bernstein in 2004. It produces a 16-byte authentication tag from a 32-byte one-time key, which is conceptually split into two parts: r, a polynomial key, and s, an additive offset used to finalize the tag. The r value is typically masked (clamped) to limit its bit-pattern and improve security. The tag is obtained by evaluating a polynomial in the prime field p = 2^130 − 5 with the message blocks as inputs, using r as the key and adding s at the end. The message is processed in 16-byte blocks; each block is incorporated into a running accumulator through modular arithmetic, and the final value is combined with s and truncated to 16 bytes to form the tag.

Poly1305 is designed to be fast and portable, with the security of the MAC relying on the secrecy of the one-time key. Because the key should be used only once, proper protocols derive a fresh 32-byte Poly1305 key for each message or session. A common practical deployment is ChaCha20-Poly1305, where a one-time Poly1305 key is derived from the ChaCha20 keystream for a given key and nonce, and the resulting tag authenticates both ciphertext and additional data. This construction is widely used in modern protocols and libraries for its combination of security and performance.

In usage, Poly1305 provides authenticity and integrity without encryption. It is important to ensure that the 32-byte one-time key is never reused for a different message, and that the implementation performs operations in constant time to resist timing side-channel attacks. Poly1305 has become a standard component in secure communication, particularly within AEAD schemes.