ChaCha20 Stream Cipher Specification
ChaCha20 is a high-speed ARX-based stream cipher, a variant of Salsa20 with improved diffusion, used in TLS and SSH.
Core Construction
ChaCha20 is a 256-bit-key stream cipher built from add-rotate-xor (ARX) quarter-round operations. It operates on a 4x4 state matrix of 32-bit words initialized with constants, key, counter, and nonce. Twenty rounds (10 double rounds) are applied to produce the keystream. The design avoids table lookups, making it naturally constant-time and side-channel resistant.
- key size
- 256 bits
- nonce
- 96 bits (IETF) or 64 bits
- rounds
- 20 rounds
32 bytes12 bytes10 double roundsDeployment and Security
ChaCha20-Poly1305 is standardized as an AEAD cipher in RFC 8439 and deployed in TLS 1.3 and SSH. It achieves high performance on architectures without AES hardware acceleration. No practical attacks are known on the full 20-round cipher. The constant-time property makes it preferable to AES in software-only environments.
- AEAD
- ChaCha20-Poly1305
- TLS 1.3
- Mandatory cipher suite
- performance
- ~3 cycles/byte
RFC 8439no AES-NI neededARM/x86 software