ChaCha20

ChaCha20
Sissssou · CC BY-SA 3.0 · source
Name	ChaCha20
Designer	Daniel J. Bernstein
Type	Stream cipher
Key size	256 bits
Nonce	64 or 96 bits
Rounds	20 (standard), 8, 12
Published	2008

ChaCha20 is a high-performance stream cipher designed for software efficiency and cryptographic robustness. Created to improve on the Salsa20 family, it appears in numerous standards and protocols adopted by organizations and projects across academia and industry. ChaCha20 has been analyzed by researchers from institutions and labs and integrated into implementations used by companies, operating systems, and open-source communities.

History and variants

ChaCha20 was introduced by Daniel J. Bernstein in 2008 as a variant of the Salsa20 cipher originally published by the same author. Following its design, several variants and rounds choices—including 20, 12, and 8 rounds—were evaluated by researchers at institutions such as Technische Universität Darmstadt, École Polytechnique, ETH Zurich, and laboratories like NCC Group and Cryptography Research, Inc.. The cipher gained traction through adoption in standards influenced by bodies like the Internet Engineering Task Force and projects involving companies such as Google, OpenSSL Software Foundation, Mozilla Foundation, and Microsoft Corporation. ChaCha20’s integration into protocols prompted comparisons with contemporaries including Advanced Encryption Standard, AES-GCM, and ciphers studied by teams at National Institute of Standards and Technology and Boeing Research & Technology. Variants tailored for specific nonce sizes and counter layouts emerged, with analysis by researchers affiliated with University of Illinois Urbana–Champaign, University of Cambridge, Massachusetts Institute of Technology, and the University of California, Berkeley.

Design and algorithm

ChaCha20 builds on a 4x4 matrix state and a sequence of 32-bit addition, XOR, and rotation operations, drawing lineage from Bernstein’s earlier work on Salsa20. The design emphasizes simplicity and resistance to timing attacks, enabling safe use in software implementations maintained by projects such as OpenBSD, FreeBSD, and NetBSD. Internal constants reference ASCII words associated with RFCs and influence interoperability in stacks deployed by Google LLC, Apple Inc., and Intel Corporation. The algorithm’s parameters—256-bit key, 64-bit or 96-bit nonce, and 32-bit block counter—reflect choices evaluated in workshops attended by participants from Carnegie Mellon University, University of Waterloo, and École Normale Supérieure. Round functions and quarter-round operations were topics at conferences including CRYPTO, EUROCRYPT, and ASIACRYPT, with reviewers from University College London and University of Tokyo contributing to formal descriptions used in libraries like libsodium and BoringSSL.

Security analysis and cryptanalysis

Cryptanalysis of ChaCha20 has been undertaken by teams from ANSSI, CNRS, and research groups at University of Rome, focusing on reduced-round distinguishers, differential cryptanalysis, and algebraic techniques. Public key players and academic contributors such as Tanja Lange and groups at Technion – Israel Institute of Technology explored entropy bounds and resilience to key-recovery attacks, while submissions to venues like IACR and papers from Danish Technical University detailed structural properties. Evaluations compared resistance to exploitation with standards vetted by NIST and considered side-channel considerations reported by engineers at Intel and ARM Holdings. Efforts by security firms including Cisco Talos and Kaspersky Lab assessed deployment risks, and formal verification attempts were undertaken by teams at Microsoft Research and Google Research.

Implementations and performance

ChaCha20 is implemented across cryptographic libraries and software stacks from organizations such as OpenSSL Software Foundation, LibreSSL, Mozilla Corporation, Google, and Apple. High-performance implementations utilize vector extensions from Intel Corporation (e.g., AVX2), ARM Ltd. (e.g., NEON), and platform optimizations used in projects maintained by Red Hat and Canonical Ltd.. Benchmarks published by researchers at University of California, Santa Barbara and engineers at Cloudflare compared throughput and latency against AES-NI accelerated implementations and pure-software ciphers used by Dropbox and Facebook. Implementations are audited by firms like Trail of Bits and Riot Micro and are included in language runtimes such as OpenJDK, Go, and Node.js.

Applications and protocols

ChaCha20 is used in transport and cryptographic protocols standardized or influenced by the IETF and deployed by tech companies including Google, Apple, and Mozilla Foundation. It appears in protocol combinations with authenticator modes developed by researchers at University of Luxembourg and corporations such as Cloudflare and is paired with Poly1305 MAC in constructions reviewed in RFCs adopted by IETF working groups. Applications include secure tunnels in projects like WireGuard, VPNs used by OpenVPN, and security stacks in Android and iOS maintained by Google and Apple. It is present in secure messaging implementations by organizations such as Signal Messenger and libraries used by Amazon Web Services and Microsoft Azure.

Patents and licensing issues

ChaCha20’s design by Daniel J. Bernstein is distributed under permissive terms and has been widely implemented in open-source projects such as those maintained by OpenBSD and Mozilla Foundation. Licensing and patent landscapes were examined by legal teams at Red Hat, Canonical Ltd., and counsel representing Google LLC and Microsoft Corporation. Audits by organizations like The Linux Foundation and law firms with clients including Oracle Corporation assessed freedom-to-operate for integration into products distributed by VMware, Inc. and cloud providers such as Amazon Web Services.

Category:Stream ciphers