DataTerminology.comNEW
A modern software‐optimized stream cipher by Daniel J. Bernstein, widely used with Poly1305 for authenticated encryption.
DESCRIPTION
ChaCha20 is a variant of Salsa20 designed for high speed and security on general-purpose CPUs without specialized instructions. The IETF standardized ChaCha20-Poly1305 for AEAD in TLS, QUIC, and SSH. It offers strong security margins, resistance to timing attacks when implemented properly, and robust performance on mobile devices. Nonce management and unique key/nonce pairs are critical to safety. It is favored where AES acceleration is unavailable or side-channel resistance is prioritized.
ALTERNATIVE DEFINITIONS
Wikipedia
ChaCha20 is a stream cipher developed by Daniel J. Bernstein as a variant of Salsa20.
Identifies lineage and algorithm class concisely.
IETF (RFC 8439)
This document defines the ChaCha20 stream cipher and the Poly1305 authenticator, and describes their use in the ChaCha20-Poly1305 AEAD construction.
Standardized AEAD construction and usage contexts.
RELATED TERMS
Poly1305 ChaCha20-Poly1305 Stream Cipher TLS 1.3 Nonce Keystream IETF RFC 8439 libsodium
COMPETING TERMS
RELATIONS
- Broader: Stream Cipher
KNOWLEDGE AREAS
Data Security Infrastructure Software Engineering
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Software Developer DevOps Engineer Cloud Architect
EXTERNAL SOURCES
- Wikipedia - ChaCha20
- IETF - ChaCha20-Poly1305 AEAD standard
- libsodium - Developer docs for ChaCha20 usage
- Cloudflare - Engineering deep dive into ChaCha20-Poly1305
TOP QUESTIONS
Why use ChaCha20 over AES-GCM?
ChaCha20 performs well without hardware acceleration and resists certain timing side channels. It’s preferred on mobile and some CPUs lacking AES-NI.
Category: Comparison
How does ChaCha20 achieve speed on general CPUs?
It uses ARX (add-rotate-xor) operations, which map efficiently to common CPU instructions and avoid lookup tables.
Category: Technical
Is ChaCha20 secure on its own?
As a stream cipher it provides confidentiality only. Pair with Poly1305 (AEAD) to obtain authenticity and integrity.
Category: Risks
What are the key nonce requirements for ChaCha20?
Never reuse a key/nonce pair. Nonce uniqueness is essential; reuse catastrophically compromises security.
Category: Best practices
Where is ChaCha20 deployed?
TLS 1.3, QUIC, SSH, and many mobile applications employ ChaCha20-Poly1305 for AEAD.
Category: Applications
How does ChaCha20 compare to Salsa20?
ChaCha20 modifies the quarter-round function for improved diffusion and passes additional cryptanalysis while remaining fast.
Category: Comparison
Is ChaCha20 vulnerable to timing attacks?
Proper constant-time implementations are resistant because ARX avoids secret-dependent memory access.
Category: Security
What key sizes does ChaCha20 use?
ChaCha20 uses a 256-bit key and a 96-bit nonce in IETF profiles.
Category: Technical
How do I choose between AES-GCM and ChaCha20-Poly1305?
Prefer AES-GCM with reliable hardware acceleration; otherwise ChaCha20-Poly1305 offers competitive performance and robust security.
Category: Guidance