Module crypto::chacha20
ChaCha20, Poly1305 and the ChaCha20-Poly1305 AEAD (RFC 8439).
ChaCha20 is the 20-round stream cipher with a 32-byte key, a 12-byte nonce and a 32-bit block counter (RFC 8439 §2.4); Poly1305 the one-time authenticator (§2.5); the AEAD composes them with the Poly1305 key taken from block 0 of the keystream (§2.8). All three run in constant time: no table lookups and no branches on key, nonce, message or tag bytes, and the tag comparison of chacha20_poly1305_open looks at every byte. It is the record protection of TLS_CHACHA20_POLY1305_SHA256 (std/tls).
unsigned char tag[16];
std::chacha20_poly1305_seal(key, nonce, aad, aadLen, msg, msgLen, tag); // msg encrypted in place
if (!std::chacha20_poly1305_open(key, nonce, aad, aadLen, msg, msgLen, tag)) { /* forged */ }
Never reuse a nonce with the same key. Freestanding-safe.
Structs
| Poly1305 | Streaming Poly1305 with a one-time 32-byte key (r || s). |
Functions
| chacha20_xor | XORs the ChaCha20 keystream for (key, nonce), starting at block 'counter', into data[0..len) — encryption and decryption are the same. |
| chacha20_block | Writes the 64-byte ChaCha20 block 'counter' for (key, nonce). |
| poly1305 | One-shot Poly1305: the 16-byte tag of msg[0..len) under 'key'. |
| chacha20_poly1305_seal | AEAD_CHACHA20_POLY1305 (RFC 8439 §2.8): encrypts data[0..len) in place and writes the 16-byte tag over aad[0..aad_len) (aad may be null when aad_len is 0) and the ciphertext. |
| chacha20_poly1305_open | Checks the tag in constant time and, only if it is authentic, decrypts data[0..len) in place. 1 if authentic, 0 if not (data is then left as the unauthenticated ciphertext). |
Macros
| CHACHA20_KEY_SIZE | |
| CHACHA20_NONCE_SIZE | |
| POLY1305_KEY_SIZE | |
| POLY1305_TAG_SIZE |