Symmetric ciphersRecommended
ChaCha20 and ChaCha20-Poly1305
Symmetric stream cipher (AEAD with Poly1305)
How it works
ChaCha20 is a stream cipher designed by Daniel J. Bernstein. It generates a keystream from the key, a nonce and a block counter, and XORs that keystream with the plaintext. Paired with the Poly1305 authenticator it becomes ChaCha20-Poly1305, an AEAD construction standardised in RFC 8439.
Sizes: 256-bit key; 96-bit nonce (IETF version); 128-bit Poly1305 tag
Strengths
- Fast and constant-time in plain software, which makes it attractive on devices without AES hardware support.
- One of the AEAD cipher suites in TLS 1.3; also used in SSH and WireGuard.
- Simple design with no lookup tables, reducing side-channel risk.
Weaknesses and known attacks
- Reusing a nonce with the same key reuses the keystream, exposing the XOR of the two plaintexts and breaking Poly1305 authentication.
- Not a FIPS-approved algorithm, so it may not be allowed in environments that require FIPS 140 validated modules.
Use it for
- TLS 1.3 and VPN traffic, especially on mobile and embedded CPUs
- Authenticated encryption in new protocol designs
Don't use it for
- Any design that cannot guarantee a unique nonce per key
- FIPS-only environments
Exam tip
ChaCha20 is a stream cipher, not a block cipher. ChaCha20-Poly1305 and AES-GCM are the two AEAD families you will see in TLS 1.3.