Cryptology Academy · Lesson

ChaCha20-Poly1305 AEAD in TLS 1.3

See ChaCha20 deployed as an AEAD cipher in modern TLS.

Lesson 4 of 413 steps

ChaCha20-Poly1305 AEAD in TLS 1.3 is a free Cryptology Academy lesson on CoddyKit. This is lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

ChaCha20-Poly1305 combines the ChaCha20 stream cipher with the Poly1305 MAC to create a secure AEAD cipher suite used in TLS 1.3, WireGuard, and mobile applications.

Poly1305 MAC Overview

Poly1305 is a one-time MAC designed by Bernstein. It authenticates a message using polynomial evaluation over the prime 2^130-5. One-time: each use requires a fresh 32-byte key.

Poly1305 Security

Poly1305 achieves 128-bit security if the key is never reused. The MAC key is derived fresh for each message from ChaCha20 keystream. The combination is provably secure.

ChaCha20-Poly1305 Construction

1. Generate 64-byte keystream from ChaCha20 block 0 2. First 32 bytes = Poly1305 key 3. Remaining 32 bytes discarded 4. Encrypt plaintext with ChaCha20 blocks 1,2,3,... 5. Compute Poly1305 MAC over AAD + ciphertext

RFC 8439 Structure

Output format: ciphertext || tag (16 bytes) MAC input: AAD || pad1 || ciphertext || pad2 || len(AAD) || len(ciphertext) Pad: zero-pad to 16-byte alignment. Lengths encoded as little-endian 64-bit integers.

TLS 1.3 Cipher Suites

TLS 1.3 mandatory cipher suites: - TLS_AES_256_GCM_SHA384 - TLS_AES_128_GCM_SHA256 - TLS_CHACHA20_POLY1305_SHA256 CHACHA20_POLY1305 is preferred for clients without AES hardware acceleration.

WireGuard Uses ChaCha20-Poly1305

WireGuard exclusively uses ChaCha20Poly1305 for all tunnel encryption. No cipher negotiation — one well-analyzed algorithm. This simplicity reduces attack surface dramatically.

libsodium secretbox

libsodium's crypto_secretbox_easy() uses XSalsa20-Poly1305 (extended nonce variant): ciphertext = crypto_secretbox_easy(message, nonce, key) High-level API: just works correctly without parameter choices.

Performance on Mobile

Android and iOS devices often lack AES-NI. Google's 2014 analysis showed ChaCha20-Poly1305 was 3× faster than AES-GCM on ARM. This is why Google mandated it in Android and Chrome.

Implementing in Python

from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305 import os key = ChaCha20Poly1305.generate_key() nonce = os.urandom(12) aad = b'header_data' cipher = ChaCha20Poly1305(key) ct = cipher.encrypt(nonce, b'plaintext', aad) pt = cipher.decrypt(nonce, ct, aad)

Comparison: AES-GCM vs ChaCha20-Poly1305

AES-GCM: faster with AES-NI, 96-bit nonce, GCM tag forgery if nonce reused. ChaCha20-Poly1305: faster without hardware, 96-bit nonce, Poly1305 key is fresh per message. Both are excellent. Use AES-GCM on servers; ChaCha20-Poly1305 on mobile.

Quick Check

In ChaCha20-Poly1305, how is the Poly1305 key generated?

Answer it in the interactive lesson

Recap

ChaCha20-Poly1305 is the mobile-optimized AEAD choice. Next we study Diffie-Hellman key exchange — how two parties establish a shared secret over an insecure channel.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “ChaCha20-Poly1305 AEAD in TLS 1.3” lesson free?

Yes — the full text of “ChaCha20-Poly1305 AEAD in TLS 1.3” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “ChaCha20-Poly1305 AEAD in TLS 1.3”?

See ChaCha20 deployed as an AEAD cipher in modern TLS. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.

How long does the “ChaCha20-Poly1305 AEAD in TLS 1.3” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cryptology Academy