ChaCha20-Poly1305: Difference between revisions

Content deleted Content added

Inline

Revision as of 16:43, 23 May 2022

ChaCha20-Poly1305 is an Authenticated encryption with additional data (AEAD) algorithm, that combines the ChaCha20 stream cipher with the Poly1305 message authentication code. Its usage in IETF protocols is standardized in RFC 8439.^[1] It has fast software performance, and without hardware acceleration, is usually faster than AES-GCM.^[2]

History

The two building blocks of the construction, the algorithms Poly1305 and ChaCha20, were both independently designed, in 2005 and 2008, by Daniel J. Bernstein.^[3]^[4]

In 2013–2014, a variant of the original ChaCha20 algorithm (using 32-bit counter and 96-bit nonce) and a variant of the original Poly1305 (authenticating 2 strings) were combined in an IETF draft^[5]^[6] to be used in TLS and DTLS,^[7] and chosen by Google, for security and performance reasons, as a newly supported cipher.^[8] Shortly after Google's adoption for TLS, ChaCha20, Poly1305 and the combined AEAD mode are added to OpenSSH via thechacha20-poly1305@openssh.com authenticated encryption cipher^[9]^[10] but kept the original 64-bit counter and 64-bit nonce for the ChaCha20 algorithm.

In 2015, the AEAD algorithm is standardized in RFC 7539^[11] and RFC 7905^[12] to be used in TLS 1.2 and DTLS 1.2 and in RFC 7634^[13] to be used in IPsec. The same year, it is integrated in Cloudflare as an alternative ciphersuite.^[14]

In June 2018, the RFC 7539 is updated and replaced by RFC 8439.^[15]

ChaCha20-Poly1305 is currently being standardized for use in QUIC.^[16]

Description

The ChaCha20-Poly1305 algorithm as described in RFC 8439^[1] take as input a 256-bit key and a 96-bit nonce to encrypt a plaintext, with a ciphertext expansion of 128-bit (the tag size). In the ChaCha20-Poly1305 construction, ChaCha20 is used in counter mode to derive a key stream that is XORed with the plaintext. The ciphertext and the associated data is then authenticated using a variant of Poly1305 that first encodes the two strings into one.

Variants

XChaCha20-Poly1305 - Extended Nonce Variant

The XChaCha20-Poly1305 construction is an extended 192-bit nonce variant of the ChaCha20-Poly1305 construction, using XChaCha20 instead of ChaCha20. When choosing nonces at random, the XChaCha20-Poly1305 construction allows for better security than the original construction. The draft attempt to standardize the construction expired in July 2020.^[17]

Salsa20-Poly1305 and XSalsa20-Poly1305

Salsa20-Poly1305 and XSalsa20-Poly1305 are variants of the ChaCha20-Poly1305 and XChaCha20-Poly1305 algorithms, using Salsa20 and XSalsa20 in place of ChaCha20 and XChaCha20. They are implemented in NaCl^[18] and libsodium^[19] but not standardized. The variants using ChaCha is preferred in practice as it provides better diffusion per round than Salsa.^[3]

Use

ChaCha20-Poly1305 is used in IPsec,^[13] SSH,^[9] TLS 1.2, DTLS 1.2, TLS 1.3,^[12] QUIC,^[16] WireGuard,^[20] S/MIME 4.0,^[21] OTRv4^[22] and multiple other protocols. Among others, it is implemented in OpenSSL, OpenSSH and libsodium.

Performance

ChaCha20-Poly1305 usually offers better performance than the more prevalent AES-GCM algorithm on systems where the CPU(s) does not feature the AES-NI instruction set extension.^[2] As a result, ChaCha20-Poly1305 is sometimes preferred over AES-GCM due to it's similar levels of security and in certain use cases involving mobile devices, which mostly use ARM-based CPUs.

Security

The ChaCha20-Poly1305 construction is proven secure in the standard model and the ideal permutation model, for the single- and multi-user setting.^[23] However, similarly to GCM, the security relies on choosing a unique nonce for every message encrypted. Compared to AES-GCM, implementations of ChaCha20-Poly1305 are less vulnerable to timing attacks.

External links

RFC 8439: ChaCha20 and Poly1305 for IETF Protocols
RFC 7634: ChaCha20, Poly1305, and Their Use in the Internet Key Exchange Protocol (IKE) and IPsec
RFC 7905: ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS)
RFC 8103: Using ChaCha20-Poly1305 Authenticated Encryption in the Cryptographic Message Syntax (CMS)

References

^ ^a ^b Nir, Yoav; Langley, Adam (June 2018). ChaCha20 and Poly1305 for IETF Protocols. doi:10.17487/RFC8439. RFC 8439.
^ ^a ^b Nir, Yoav; Langley, Adam (June 2018). "Performance Measurements of ChaCha20". ChaCha20 and Poly1305 for IETF Protocols. sec. B. doi:10.17487/RFC8439. RFC 8439.
^ ^a ^b Bernstein, D. J. (January 2008). ChaCha, a variant of Salsa20 (PDF). The State of the Art of Stream Ciphers. Vol. 8. pp. 3–5.
^ Bernstein, Daniel J. (2005), "The Poly1305-AES Message-Authentication Code", Fast Software Encryption, Berlin, Heidelberg: Springer Berlin Heidelberg, pp. 32–49, doi:10.1007/11502760_3, ISBN 978-3-540-26541-2
^ Langley, Adam (September 2013). ChaCha20 and Poly1305 based Cipher Suites for TLS. I-D draft-agl-tls-chacha20poly1305-00.
^ Nir, Yoav (27 January 2014). ChaCha20 and Poly1305 for IETF protocols. I-D draft-nir-cfrg-chacha20-poly1305-00.
^ Langley, Adam; Chang, Wan-Teh; Mavrogiannopoulos, Nikos; Strombergson, Joachim; Josefsson, Simon (24 January 2014). The ChaCha Stream Cipher for Transport Layer Security. I-D draft-mavrogiannopoulos-chacha-tls-01.
^ Bursztein, Elie (24 April 2014). "Speeding up and strengthening HTTPS connections for Chrome on Android". Google Online Security Blog. Archived from the original on 2016-09-28. Retrieved 2021-12-27.
^ ^a ^b Miller, Damien. "Super User's BSD Cross Reference: /OpenBSD/usr.bin/ssh/PROTOCOL.chacha20poly1305". bxr.su. Archived from the original on 2013-12-13. Retrieved 2021-12-28.
^ Miller, Damien (29 November 2013). "ChaCha20 and Poly1305 in OpenSSH". Archived from the original on 2013-12-13. Retrieved 2021-12-28.
^ Nir, Yoav; Langley, Adam (May 2015). ChaCha20 and Poly1305 for IETF Protocols. doi:10.17487/RFC7539. RFC 7539.
^ ^a ^b Langley, Adam; Chang, Wan-Teh; Mavrogiannopoulos, Nikos; Strombergson, Joachim; Josefsson, Simon (June 2016). ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS). doi:10.17487/RFC7905. RFC 7905.
^ ^a ^b Nir, Yoav (August 2015). ChaCha20, Poly1305, and Their Use in the Internet Key Exchange Protocol (IKE) and IPsec. doi:10.17487/RFC7634. RFC 7634.
^ "Do the ChaCha: better mobile performance with cryptography". The Cloudflare Blog. 2015-02-23. Retrieved 2021-12-28.
^ Nir, Yoav; Langley, Adam (June 2018). ChaCha20 and Poly1305 for IETF Protocols. doi:10.17487/RFC8439. RFC 8439.
^ ^a ^b Thomson, Martin; Turner, Sean (May 2021). Using TLS to Secure QUIC. doi:10.17487/RFC9001. RFC 9001.
^ Arciszewski, Scott (10 January 2020). XChaCha: eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305. I-D draft-irtf-cfrg-xchacha.
^ "NaCl: Networking and Cryptography library - Secret-key authenticated encryption". Archived from the original on 2009-06-30.
^ "libsodium - Authenticated encryption". Archived from the original on 2020-08-04.
^ Donenfeld, Jason A. "Protocol & Cryptography - WireGuard". www.wireguard.com. Retrieved 2021-12-28.
^ Housley, Russ (February 2017). Using ChaCha20-Poly1305 Authenticated Encryption in the Cryptographic Message Syntax (CMS). doi:10.17487/RFC8103. RFC 8103.
^ OTRv4, OTRv4, 2021-12-25, retrieved 2021-12-28
^ Degabriele, Jean Paul; Govinden, Jérôme; Günther, Felix; Paterson, Kenneth G. (2021-11-12), "The Security of ChaCha20-Poly1305 in the Multi-User Setting", Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA: Association for Computing Machinery, pp. 1981–2003, doi:10.1145/3460120.3484814, ISBN 978-1-4503-8454-4, retrieved 2021-12-27

[:1-1] Nir, Yoav; Langley, Adam (June 2018). ChaCha20 and Poly1305 for IETF Protocols. doi:10.17487/RFC8439. RFC 8439.

[:0-2] Nir, Yoav; Langley, Adam (June 2018). "Performance Measurements of ChaCha20". ChaCha20 and Poly1305 for IETF Protocols. sec. B. doi:10.17487/RFC8439. RFC 8439.

[:6-3] Bernstein, D. J. (January 2008). ChaCha, a variant of Salsa20 (PDF). The State of the Art of Stream Ciphers. Vol. 8. pp. 3–5.

[4] Bernstein, Daniel J. (2005), "The Poly1305-AES Message-Authentication Code", Fast Software Encryption, Berlin, Heidelberg: Springer Berlin Heidelberg, pp. 32–49, doi:10.1007/11502760_3, ISBN 978-3-540-26541-2

[5] Langley, Adam (September 2013). ChaCha20 and Poly1305 based Cipher Suites for TLS. I-D draft-agl-tls-chacha20poly1305-00.

[6] Nir, Yoav (27 January 2014). ChaCha20 and Poly1305 for IETF protocols. I-D draft-nir-cfrg-chacha20-poly1305-00.

[7] Langley, Adam; Chang, Wan-Teh; Mavrogiannopoulos, Nikos; Strombergson, Joachim; Josefsson, Simon (24 January 2014). The ChaCha Stream Cipher for Transport Layer Security. I-D draft-mavrogiannopoulos-chacha-tls-01.

[8] Bursztein, Elie (24 April 2014). "Speeding up and strengthening HTTPS connections for Chrome on Android". Google Online Security Blog. Archived from the original on 2016-09-28. Retrieved 2021-12-27.

[:2-9] Miller, Damien. "Super User's BSD Cross Reference: /OpenBSD/usr.bin/ssh/PROTOCOL.chacha20poly1305". bxr.su. Archived from the original on 2013-12-13. Retrieved 2021-12-28.

[10] Miller, Damien (29 November 2013). "ChaCha20 and Poly1305 in OpenSSH". Archived from the original on 2013-12-13. Retrieved 2021-12-28.

[11] Nir, Yoav; Langley, Adam (May 2015). ChaCha20 and Poly1305 for IETF Protocols. doi:10.17487/RFC7539. RFC 7539.

[:3-12] Langley, Adam; Chang, Wan-Teh; Mavrogiannopoulos, Nikos; Strombergson, Joachim; Josefsson, Simon (June 2016). ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS). doi:10.17487/RFC7905. RFC 7905.

[:4-13] Nir, Yoav (August 2015). ChaCha20, Poly1305, and Their Use in the Internet Key Exchange Protocol (IKE) and IPsec. doi:10.17487/RFC7634. RFC 7634.

[14] "Do the ChaCha: better mobile performance with cryptography". The Cloudflare Blog. 2015-02-23. Retrieved 2021-12-28.

[15] Nir, Yoav; Langley, Adam (June 2018). ChaCha20 and Poly1305 for IETF Protocols. doi:10.17487/RFC8439. RFC 8439.

[:5-16] Thomson, Martin; Turner, Sean (May 2021). Using TLS to Secure QUIC. doi:10.17487/RFC9001. RFC 9001.

[17] Arciszewski, Scott (10 January 2020). XChaCha: eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305. I-D draft-irtf-cfrg-xchacha.

[18] "NaCl: Networking and Cryptography library - Secret-key authenticated encryption". Archived from the original on 2009-06-30.

[19] "libsodium - Authenticated encryption". Archived from the original on 2020-08-04.

[20] Donenfeld, Jason A. "Protocol & Cryptography - WireGuard". www.wireguard.com. Retrieved 2021-12-28.

[21] Housley, Russ (February 2017). Using ChaCha20-Poly1305 Authenticated Encryption in the Cryptographic Message Syntax (CMS). doi:10.17487/RFC8103. RFC 8103.

[22] OTRv4, OTRv4, 2021-12-25, retrieved 2021-12-28

[23] Degabriele, Jean Paul; Govinden, Jérôme; Günther, Felix; Paterson, Kenneth G. (2021-11-12), "The Security of ChaCha20-Poly1305 in the Multi-User Setting", Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA: Association for Computing Machinery, pp. 1981–2003, doi:10.1145/3460120.3484814, ISBN 978-1-4503-8454-4, retrieved 2021-12-27

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]

[18]

[19]

[20]

[21]

[22]

[23]

@@ Line 1: / Line 1: @@
 {{Short description|Authenticated encryption with additional data algorithm}}
-'''ChaCha20-Poly1305''' is an [[Authenticated encryption|Authenticated encryption with additional data (AEAD)]] algorithm, that combines the [[Salsa20#ChaCha variant|ChaCha20]] [[Stream cipher|stream cipher]] with the [[Poly1305]] message authentication code. Its usage in IETF protocols is standardized in <nowiki>RFC 8439</nowiki>.<ref name=":1">{{Cite journal|last=Nir|first=Yoav|last2=Langley|first2=Adam|date=June 2018|title=ChaCha20 and Poly1305 for IETF Protocols|url=https://datatracker.ietf.org/doc/rfc8439/|journal=RFC 8439}}</ref> It has fast software performance, and without hardware acceleration, is usually faster than AES-GCM.<ref name=":0">{{Cite journal|last=Nir|first=Yoav|last2=Langley|first2=Adam|date=June 2018|title=ChaCha20 and Poly1305 for IETF Protocols - Appendix B: Performance Measurements of ChaCha20|url=https://datatracker.ietf.org/doc/html/rfc8439#appendix-B|journal=RFC 8439}}</ref>
+'''ChaCha20-Poly1305''' is an [[Authenticated encryption|Authenticated encryption with additional data (AEAD)]] algorithm, that combines the [[Salsa20#ChaCha variant|ChaCha20]] [[Stream cipher|stream cipher]] with the [[Poly1305]] message authentication code. Its usage in IETF protocols is standardized in <nowiki>RFC 8439</nowiki>.<ref name=":1">{{Cite IETF|last1=Nir|first1=Yoav|last2=Langley|first2=Adam|date=June 2018|title=ChaCha20 and Poly1305 for IETF Protocols|rfc=8439}}</ref> It has fast software performance, and without hardware acceleration, is usually faster than AES-GCM.<ref name=":0">{{Cite IETF|last1=Nir|first1=Yoav|last2=Langley|first2=Adam|date=June 2018|title=ChaCha20 and Poly1305 for IETF Protocols|rfc=8439|appendix=B|sectionname=Performance Measurements of ChaCha20}}</ref>
 == History ==
-The two building blocks of the construction, the algorithms Poly1305 and ChaCha20, were both independently designed, in 2005 and 2008, by [[Daniel J. Bernstein]].<ref name=":6">Bernstein, D. J. (2008, January). ChaCha, a variant of Salsa20. In ''Workshop record of SASC'' (Vol. 8, pp. 3-5).</ref><ref>{{Citation|last=Bernstein|first=Daniel J.|title=The Poly1305-AES Message-Authentication Code|date=2005|url=http://dx.doi.org/10.1007/11502760_3|work=Fast Software Encryption|pages=32–49|place=Berlin, Heidelberg|publisher=Springer Berlin Heidelberg|isbn=978-3-540-26541-2|access-date=2021-12-27}}</ref>
+The two building blocks of the construction, the algorithms Poly1305 and ChaCha20, were both independently designed, in 2005 and 2008, by [[Daniel J. Bernstein]].<ref name=":6">{{Cite conference |last=Bernstein |first=D. J. |date=January 2008 |title=ChaCha, a variant of Salsa20 |url=https://cr.yp.to/chacha/chacha-20080120.pdf |conference=The State of the Art of Stream Ciphers |volume=8 |pages=3-5}}</ref><ref>{{Citation |last=Bernstein |first=Daniel J. |title=The Poly1305-AES Message-Authentication Code |date=2005 |work=Fast Software Encryption |pages=32–49 |place=Berlin, Heidelberg |publisher=Springer Berlin Heidelberg |doi=10.1007/11502760_3 |isbn=978-3-540-26541-2}}</ref>
-In 2013–2014, a variant of the original ChaCha20 algorithm (using 32-bit counter and 96-bit nonce) and a variant of the original Poly1305 (authenticating 2 strings) were combined in an IETF draft<ref>{{Cite journal|last=Langley|first=Adam|date=September 2013|title=ChaCha20 and Poly1305 based Cipher Suites for TLS - draft-agl-tls-chacha20poly1305-00|url=https://datatracker.ietf.org/doc/draft-agl-tls-chacha20poly1305/00/|journal=}}</ref><ref>{{Cite journal|last=Nir|first=Yoav|date=27 January 2014|title=ChaCha20 and Poly1305 for IETF protocols - draft-nir-cfrg-chacha20-poly1305-00|url=https://datatracker.ietf.org/doc/draft-nir-cfrg-chacha20-poly1305/00/|journal=}}</ref> to be used in [[Transport Layer Security|TLS]] and [[Datagram Transport Layer Security|DTLS]],<ref>{{Cite journal|last=Langley|first=Adam|last2=Chang|first2=Wan-Teh|last3=Mavrogiannopoulos|first3=Nikos|last4=Strombergson|first4=Joachim|last5=Josefsson|first5=Simon|date=24 January 2014|title=The ChaCha Stream Cipher for Transport Layer Security - draft-mavrogiannopoulos-chacha-tls-01|url=https://datatracker.ietf.org/doc/draft-mavrogiannopoulos-chacha-tls/01/|journal=}}</ref> and chosen by [[Google]], for security and performance reasons, as a newly supported cipher.<ref>{{Cite web|last=Bursztein|first=Elie|date=24 April 2014|title=Speeding up and strengthening HTTPS connections for Chrome on Android|url=https://security.googleblog.com/2014/04/speeding-up-and-strengthening-https.html|url-status=live|access-date=2021-12-27|website=Google Online Security Blog|language=en|archive-url=https://web.archive.org/web/20160928013932/https://security.googleblog.com/2014/04/speeding-up-and-strengthening-https.html |archive-date=2016-09-28 }}</ref> Shortly after Google's adoption for TLS, ChaCha20, Poly1305 and the combined AEAD mode are added to [[OpenSSH]] via the<code>chacha20-poly1305@openssh.com</code> authenticated encryption cipher<ref name=":2">{{Cite web|last=Miller|first=Damien|title=Super User's BSD Cross Reference: /OpenBSD/usr.bin/ssh/PROTOCOL.chacha20poly1305|url=http://bxr.su/OpenBSD/usr.bin/ssh/PROTOCOL.chacha20poly1305|url-status=live|access-date=2021-12-28|website=bxr.su|archive-url=https://web.archive.org/web/20131213160907/http://bxr.su:80/OpenBSD/usr.bin/ssh/PROTOCOL.chacha20poly1305 |archive-date=2013-12-13 }}</ref><ref>{{Cite web|last=Miller|first=Damien|date=29 November 2013|title=ChaCha20 and Poly1305 in OpenSSH|url=http://blog.djm.net.au/2013/11/chacha20-and-poly1305-in-openssh.html|url-status=live|access-date=2021-12-28|language=en-GB|archive-url=https://web.archive.org/web/20131213215903/http://blog.djm.net.au:80/2013/11/chacha20-and-poly1305-in-openssh.html |archive-date=2013-12-13 }}</ref> but kept the original 64-bit counter and 64-bit nonce for the ChaCha20 algorithm.
+In 2013–2014, a variant of the original ChaCha20 algorithm (using 32-bit counter and 96-bit nonce) and a variant of the original Poly1305 (authenticating 2 strings) were combined in an IETF draft<ref>{{Cite IETF|last=Langley|first=Adam|date=September 2013|title=ChaCha20 and Poly1305 based Cipher Suites for TLS|draft=draft-agl-tls-chacha20poly1305-00}}</ref><ref>{{Cite IETF|last=Nir|first=Yoav|date=27 January 2014|title=ChaCha20 and Poly1305 for IETF protocols|draft=draft-nir-cfrg-chacha20-poly1305-00}}</ref> to be used in [[Transport Layer Security|TLS]] and [[Datagram Transport Layer Security|DTLS]],<ref>{{Cite IETF|last1=Langley|first1=Adam|last2=Chang|first2=Wan-Teh|last3=Mavrogiannopoulos|first3=Nikos|last4=Strombergson|first4=Joachim|last5=Josefsson|first5=Simon|date=24 January 2014|title=The ChaCha Stream Cipher for Transport Layer Security|draft=draft-mavrogiannopoulos-chacha-tls-01}}</ref> and chosen by [[Google]], for security and performance reasons, as a newly supported cipher.<ref>{{Cite web|last=Bursztein|first=Elie|date=24 April 2014|title=Speeding up and strengthening HTTPS connections for Chrome on Android|url=https://security.googleblog.com/2014/04/speeding-up-and-strengthening-https.html|url-status=live|access-date=2021-12-27|website=Google Online Security Blog|language=en|archive-url=https://web.archive.org/web/20160928013932/https://security.googleblog.com/2014/04/speeding-up-and-strengthening-https.html |archive-date=2016-09-28 }}</ref> Shortly after Google's adoption for TLS, ChaCha20, Poly1305 and the combined AEAD mode are added to [[OpenSSH]] via the<code>chacha20-poly1305@openssh.com</code> authenticated encryption cipher<ref name=":2">{{Cite web|last=Miller|first=Damien|title=Super User's BSD Cross Reference: /OpenBSD/usr.bin/ssh/PROTOCOL.chacha20poly1305|url=http://bxr.su/OpenBSD/usr.bin/ssh/PROTOCOL.chacha20poly1305|url-status=live|access-date=2021-12-28|website=bxr.su|archive-url=https://web.archive.org/web/20131213160907/http://bxr.su:80/OpenBSD/usr.bin/ssh/PROTOCOL.chacha20poly1305 |archive-date=2013-12-13 }}</ref><ref>{{Cite web|last=Miller|first=Damien|date=29 November 2013|title=ChaCha20 and Poly1305 in OpenSSH|url=http://blog.djm.net.au/2013/11/chacha20-and-poly1305-in-openssh.html|url-status=live|access-date=2021-12-28|language=en-GB|archive-url=https://web.archive.org/web/20131213215903/http://blog.djm.net.au:80/2013/11/chacha20-and-poly1305-in-openssh.html |archive-date=2013-12-13 }}</ref> but kept the original 64-bit counter and 64-bit nonce for the ChaCha20 algorithm.
-In 2015, the AEAD algorithm is standardized in <nowiki>RFC 7539</nowiki><ref>{{Cite journal|last=Nir|first=Yoav|last2=Langley|first2=Adam|date=May 2015|title=ChaCha20 and Poly1305 for IETF Protocols|url=https://datatracker.ietf.org/doc/rfc7539/|journal=RFC 7539}}</ref> and <nowiki>RFC 7905</nowiki><ref name=":3">{{Cite journal|last=Langley|first=Adam|last2=Chang|first2=Wan-Teh|last3=Mavrogiannopoulos|first3=Nikos|last4=Strombergson|first4=Joachim|last5=Josefsson|first5=Simon|date=June 2016|title=ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS)|url=https://datatracker.ietf.org/doc/rfc7905/|journal=RFC 7905}}</ref>  to be used in TLS 1.2 and DTLS 1.2 and in <nowiki>RFC 7634</nowiki><ref name=":4">{{Cite journal|last=Nir|first=Yoav|date=August 2015|title=ChaCha20, Poly1305, and Their Use in the Internet Key Exchange Protocol (IKE) and IPsec|url=https://datatracker.ietf.org/doc/rfc7634/|journal=RFC 7634}}</ref> to be used in IPsec. The same year, it is integrated in Cloudflare as an alternative ciphersuite.<ref>{{Cite web|date=2015-02-23|title=Do the ChaCha: better mobile performance with cryptography|url=http://blog.cloudflare.com/do-the-chacha-better-mobile-performance-with-cryptography/|access-date=2021-12-28|website=The Cloudflare Blog|language=en}}</ref>
+In 2015, the AEAD algorithm is standardized in <nowiki>RFC 7539</nowiki><ref>{{Cite IETF|last1=Nir|first1=Yoav|last2=Langley|first2=Adam|date=May 2015|title=ChaCha20 and Poly1305 for IETF Protocols|rfc=7539}}</ref> and <nowiki>RFC 7905</nowiki><ref name=":3">{{Cite IETF|last1=Langley|first1=Adam|last2=Chang|first2=Wan-Teh|last3=Mavrogiannopoulos|first3=Nikos|last4=Strombergson|first4=Joachim|last5=Josefsson|first5=Simon|date=June 2016|title=ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS)|rfc=7905}}</ref>  to be used in TLS 1.2 and DTLS 1.2 and in <nowiki>RFC 7634</nowiki><ref name=":4">{{Cite IETF|last=Nir|first=Yoav|date=August 2015|title=ChaCha20, Poly1305, and Their Use in the Internet Key Exchange Protocol (IKE) and IPsec|rfc=7634}}</ref> to be used in IPsec. The same year, it is integrated in Cloudflare as an alternative ciphersuite.<ref>{{Cite web|date=2015-02-23|title=Do the ChaCha: better mobile performance with cryptography|url=http://blog.cloudflare.com/do-the-chacha-better-mobile-performance-with-cryptography/|access-date=2021-12-28|website=The Cloudflare Blog|language=en}}</ref>
-In June 2018, the <nowiki>RFC 7539</nowiki> is updated and replaced by <nowiki>RFC 8439</nowiki>.<ref>{{Cite journal|last=Nir|first=Yoav|last2=Langley|first2=Adam|date=June 2018|title=ChaCha20 and Poly1305 for IETF Protocols|url=https://datatracker.ietf.org/doc/rfc8439/|journal=RFC 8439}}</ref>
+In June 2018, the <nowiki>RFC 7539</nowiki> is updated and replaced by <nowiki>RFC 8439</nowiki>.<ref>{{Cite IETF|last1=Nir|first1=Yoav|last2=Langley|first2=Adam|date=June 2018|title=ChaCha20 and Poly1305 for IETF Protocols|rfc=8439}}</ref>
-ChaCha20-Poly1305 is currently being standardized for use in [[QUIC]].<ref name=":5">{{Cite journal|last=Thomson|first=Martin|last2=Turner|first2=Sean|date=May 2021|title=Using TLS to Secure QUIC|url=https://datatracker.ietf.org/doc/rfc9001/|journal=RFC 9001}}</ref>
+ChaCha20-Poly1305 is currently being standardized for use in [[QUIC]].<ref name=":5">{{Cite IETF|last1=Thomson|first1=Martin|last2=Turner|first2=Sean|date=May 2021|title=Using TLS to Secure QUIC|rfc=9001}}</ref>
 == Description ==
@@ Line 21: / Line 21: @@
 === XChaCha20-Poly1305 - Extended Nonce Variant ===
-The XChaCha20-Poly1305 construction is an extended 192-bit nonce variant of the ChaCha20-Poly1305 construction, using [[Salsa20#XChaCha|XChaCha20]] instead of [[Salsa20#ChaCha variant|ChaCha20]]. When choosing nonces at random, the XChaCha20-Poly1305 construction allows for better security than the original construction. The draft attempt to standardize the construction expired in July 2020.<ref>{{Cite journal|last=Arciszewski|first=Scott|date=10 January 2020|title=XChaCha: eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305 - draft-irtf-cfrg-xchacha-03|url=https://datatracker.ietf.org/doc/draft-irtf-cfrg-xchacha/|journal=}}</ref>
+The XChaCha20-Poly1305 construction is an extended 192-bit nonce variant of the ChaCha20-Poly1305 construction, using [[Salsa20#XChaCha|XChaCha20]] instead of [[Salsa20#ChaCha variant|ChaCha20]]. When choosing nonces at random, the XChaCha20-Poly1305 construction allows for better security than the original construction. The draft attempt to standardize the construction expired in July 2020.<ref>{{Cite IETF|last=Arciszewski|first=Scott|date=10 January 2020|title=XChaCha: eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305|draft=draft-irtf-cfrg-xchacha}}</ref>
 === Salsa20-Poly1305 and XSalsa20-Poly1305 ===
@@ Line 27: / Line 27: @@
 == Use ==
-ChaCha20-Poly1305 is used in [[IPsec]],<ref name=":4" /> [[SSH]],<ref name=":2" /> [[Transport Layer Security#TLS 1.2|TLS 1.2]], [[Datagram Transport Layer Security|DTLS]] 1.2, [[Transport Layer Security#TLS 1.3|TLS 1.3]],<ref name=":3" /> [[QUIC]],<ref name=":5" /> [[WireGuard]],<ref>{{Cite web|last=Donenfeld|first=Jason A.|title=Protocol & Cryptography - WireGuard|url=https://www.wireguard.com/protocol/|access-date=2021-12-28|website=www.wireguard.com|language=en}}</ref> [[S/MIME|S/MIME 4.0]],<ref>{{Cite journal|last=Housley|first=Russ|date=February 2017|title=Using ChaCha20-Poly1305 Authenticated Encryption in the Cryptographic Message Syntax (CMS)|url=https://datatracker.ietf.org/doc/rfc8103/|journal=RFC 8103}}</ref> [[Off-the-Record Messaging|OTR]]<nowiki/>v4<ref>{{Citation|title=OTRv4|date=2021-12-25|url=https://github.com/otrv4/otrv4/blob/12cc3018577901e27715680ec9cb94b2562438b9/otrv4.md|publisher=OTRv4|access-date=2021-12-28}}</ref> and multiple other protocols. Among others, it is implemented in [[OpenSSL]], [[OpenSSH]] and [[libsodium]].
+ChaCha20-Poly1305 is used in [[IPsec]],<ref name=":4" /> [[SSH]],<ref name=":2" /> [[Transport Layer Security#TLS 1.2|TLS 1.2]], [[Datagram Transport Layer Security|DTLS]] 1.2, [[Transport Layer Security#TLS 1.3|TLS 1.3]],<ref name=":3" /> [[QUIC]],<ref name=":5" /> [[WireGuard]],<ref>{{Cite web|last=Donenfeld|first=Jason A.|title=Protocol & Cryptography - WireGuard|url=https://www.wireguard.com/protocol/|access-date=2021-12-28|website=www.wireguard.com|language=en}}</ref> [[S/MIME|S/MIME 4.0]],<ref>{{Cite IETF|last=Housley|first=Russ|date=February 2017|title=Using ChaCha20-Poly1305 Authenticated Encryption in the Cryptographic Message Syntax (CMS)|rfc=8103}}</ref> [[Off-the-Record Messaging|OTR]]<nowiki/>v4<ref>{{Citation|title=OTRv4|date=2021-12-25|url=https://github.com/otrv4/otrv4/blob/12cc3018577901e27715680ec9cb94b2562438b9/otrv4.md|publisher=OTRv4|access-date=2021-12-28}}</ref> and multiple other protocols. Among others, it is implemented in [[OpenSSL]], [[OpenSSH]] and [[libsodium]].
 == Performance ==
@@ Line 33: / Line 33: @@
 == Security ==
-The ChaCha20-Poly1305 construction is proven secure in the [[Standard model (cryptography)|standard model]] and the [[Random oracle#Ideal Permutation|ideal permutation model]], for the single- and multi-user setting.<ref>{{Citation|last=Degabriele|first=Jean Paul|title=The Security of ChaCha20-Poly1305 in the Multi-User Setting|date=2021-11-12|url=https://doi.org/10.1145/3460120.3484814|work=Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security|pages=1981–2003|place=New York, NY, USA|publisher=Association for Computing Machinery|doi=10.1145/3460120.3484814|isbn=978-1-4503-8454-4|access-date=2021-12-27|last2=Govinden|first2=Jérôme|last3=Günther|first3=Felix|last4=Paterson|first4=Kenneth G.}}</ref> However, similarly to [[Galois/Counter Mode|GCM]], the security relies on choosing a unique [[Cryptographic nonce|nonce]] for every message encrypted. Compared to AES-GCM, implementations of ChaCha20-Poly1305 are less vulnerable to timing attacks.
+The ChaCha20-Poly1305 construction is proven secure in the [[Standard model (cryptography)|standard model]] and the [[Random oracle#Ideal Permutation|ideal permutation model]], for the single- and multi-user setting.<ref>{{Citation |last=Degabriele |first=Jean Paul |title=The Security of ChaCha20-Poly1305 in the Multi-User Setting |date=2021-11-12 |url=https://doi.org/10.1145/3460120.3484814 |work=Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security |pages=1981–2003 |place=New York, NY, USA |publisher=Association for Computing Machinery |doi=10.1145/3460120.3484814 |isbn=978-1-4503-8454-4 |access-date=2021-12-27 |last2=Govinden |first2=Jérôme |last3=Günther |first3=Felix |last4=Paterson |first4=Kenneth G.}}</ref> However, similarly to [[Galois/Counter Mode|GCM]], the security relies on choosing a unique [[Cryptographic nonce|nonce]] for every message encrypted. Compared to AES-GCM, implementations of ChaCha20-Poly1305 are less vulnerable to timing attacks.
 ==See also==