0Pricing
Cryptology Academy · Lesson

ChaCha20-Poly1305 AEAD in TLS 1.3

See ChaCha20 deployed as an AEAD cipher in modern TLS.

ChaCha20-Poly1305 AEAD in TLS 1.3 is a free Cryptology Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

ChaCha20-Poly1305 combines the ChaCha20 stream cipher with the Poly1305 MAC to create a secure AEAD cipher suite used in TLS 1.3, WireGuard, and mobile applications.

Poly1305 MAC Overview

Poly1305 is a one-time MAC designed by Bernstein. It authenticates a message using polynomial evaluation over the prime 2^130-5. One-time: each use requires a fresh 32-byte key.

Poly1305 Security

Poly1305 achieves 128-bit security if the key is never reused. The MAC key is derived fresh for each message from ChaCha20 keystream. The combination is provably secure.

ChaCha20-Poly1305 Construction

1. Generate 64-byte keystream from ChaCha20 block 0 2. First 32 bytes = Poly1305 key 3. Remaining 32 bytes discarded 4. Encrypt plaintext with ChaCha20 blocks 1,2,3,... 5. Compute Poly1305 MAC over AAD + ciphertext

RFC 8439 Structure

Output format: ciphertext || tag (16 bytes) MAC input: AAD || pad1 || ciphertext || pad2 || len(AAD) || len(ciphertext) Pad: zero-pad to 16-byte alignment. Lengths encoded as little-endian 64-bit integers.

TLS 1.3 Cipher Suites

TLS 1.3 mandatory cipher suites: - TLS_AES_256_GCM_SHA384 - TLS_AES_128_GCM_SHA256 - TLS_CHACHA20_POLY1305_SHA256 CHACHA20_POLY1305 is preferred for clients without AES hardware acceleration.

WireGuard Uses ChaCha20-Poly1305

WireGuard exclusively uses ChaCha20Poly1305 for all tunnel encryption. No cipher negotiation — one well-analyzed algorithm. This simplicity reduces attack surface dramatically.

libsodium secretbox

libsodium's crypto_secretbox_easy() uses XSalsa20-Poly1305 (extended nonce variant): ciphertext = crypto_secretbox_easy(message, nonce, key) High-level API: just works correctly without parameter choices.

Performance on Mobile

Android and iOS devices often lack AES-NI. Google's 2014 analysis showed ChaCha20-Poly1305 was 3× faster than AES-GCM on ARM. This is why Google mandated it in Android and Chrome.

Implementing in Python

from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305 import os key = ChaCha20Poly1305.generate_key() nonce = os.urandom(12) aad = b'header_data' cipher = ChaCha20Poly1305(key) ct = cipher.encrypt(nonce, b'plaintext', aad) pt = cipher.decrypt(nonce, ct, aad)

Comparison: AES-GCM vs ChaCha20-Poly1305

AES-GCM: faster with AES-NI, 96-bit nonce, GCM tag forgery if nonce reused. ChaCha20-Poly1305: faster without hardware, 96-bit nonce, Poly1305 key is fresh per message. Both are excellent. Use AES-GCM on servers; ChaCha20-Poly1305 on mobile.

Quick Check

In ChaCha20-Poly1305, how is the Poly1305 key generated?

Recap

ChaCha20-Poly1305 is the mobile-optimized AEAD choice. Next we study Diffie-Hellman key exchange — how two parties establish a shared secret over an insecure channel.

Frequently asked questions

Is the “ChaCha20-Poly1305 AEAD in TLS 1.3” lesson free?

Yes — the full text of “ChaCha20-Poly1305 AEAD in TLS 1.3” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “ChaCha20-Poly1305 AEAD in TLS 1.3”?

See ChaCha20 deployed as an AEAD cipher in modern TLS. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “ChaCha20-Poly1305 AEAD in TLS 1.3” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Stream Cipher Concepts & PRNG
  2. RC4: Design, Weaknesses & WEP Attacks
  3. Salsa20 & ChaCha20 Design
  4. ChaCha20-Poly1305 AEAD in TLS 1.3
← Back to Cryptology Academy