0Pricing
Cryptology Academy · Lesson

Salsa20 & ChaCha20 Design

Walk through ChaCha20's quarter-round and its speed on mobile hardware.

Salsa20 & ChaCha20 Design is a free Cryptology Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

ChaCha20 is the dominant stream cipher in modern systems — used in TLS 1.3, WireGuard, Signal, and many others. Let's dissect its elegant design.

ChaCha20 Origins

Daniel J. Bernstein designed Salsa20 in 2005, then improved it to ChaCha20 in 2008. The 'Cha' prefix indicates 8 additional diffusion improvements. Standardized in RFC 7539 (2015), RFC 8439 (2018).

ChaCha20 State

ChaCha20 operates on a 4×4 matrix of 32-bit words (512 bits total): - Words 0-3: constants ('expa', 'nd 3', '2-by', 'te k') - Words 4-11: 256-bit key (8 words) - Word 12: 32-bit block counter - Words 13-15: 96-bit nonce

The Quarter Round

ChaCha20's core operation — the quarter round on (a,b,c,d): a+=b; d^=a; d<<<= 16 c+=d; b^=c; b<<<= 12 a+=b; d^=a; d<<<= 8 c+=d; b^=c; b<<<= 7 Add-Rotate-XOR (ARX). No S-boxes needed — fast on all hardware.

20 Rounds

ChaCha20 applies 20 rounds: alternating column rounds and diagonal rounds, 4 quarter-rounds each. 8 rounds = ChaCha8 (fast), 12 rounds = ChaCha12 (balanced). ChaCha20 is the secure default.

Keystream Generation

1. Initialize state from key + nonce + counter 2. Apply 20 rounds of quarter-rounds 3. Add initial state to the rotated state (prevents reverse) 4. Output 64-byte keystream block 5. Increment counter for next block

ARX Security Benefits

ARX (Add, Rotate, XOR) ciphers are naturally constant-time on most CPUs. No table lookups mean no cache-timing side channels. This is critical for secure implementations.

ChaCha20 Performance

Without AES-NI: ChaCha20 is ~3× faster than AES-CBC. On phones (ARM Cortex-A): ChaCha20 is the faster choice. With AES-NI (modern x86): AES-GCM is faster. TLS 1.3 includes both.

Salsa20 vs ChaCha20

ChaCha20 improves on Salsa20 with better diffusion in early rounds — more resistance to differential cryptanalysis. The state initialization differs. Both are secure; ChaCha20 is the current standard.

ChaCha20 in Python

from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305 import os key = ChaCha20Poly1305.generate_key() nonce = os.urandom(12) ct = ChaCha20Poly1305(key).encrypt(nonce, b'hello', None)

XChaCha20: Extended Nonce

ChaCha20 uses a 96-bit nonce. XChaCha20 extends to 192 bits using the HChaCha20 function. Larger nonces allow random generation without collision concerns. libsodium uses XChaCha20-Poly1305.

Quick Check

Why does ChaCha20's ARX design eliminate cache-timing side channels?

Recap

ChaCha20 is elegant and secure. Next we see it deployed in TLS 1.3 as ChaCha20-Poly1305 AEAD.

Frequently asked questions

Is the “Salsa20 & ChaCha20 Design” lesson free?

Yes — the full text of “Salsa20 & ChaCha20 Design” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “Salsa20 & ChaCha20 Design”?

Walk through ChaCha20's quarter-round and its speed on mobile hardware. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Salsa20 & ChaCha20 Design” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Stream Cipher Concepts & PRNG
  2. RC4: Design, Weaknesses & WEP Attacks
  3. Salsa20 & ChaCha20 Design
  4. ChaCha20-Poly1305 AEAD in TLS 1.3
← Back to Cryptology Academy