copy from：https://en.wikipedia.org/wiki/ChaCha20-Poly1305
ChaCha20-Poly1305 is an authenticated encryption with additional data (AEAD) algorithm, that combines the ChaCha20 stream cipher with the Poly1305 message authentication code. Its usage in IETF protocols is standardized in RFC 8439.[1] It has fast software performance, and without hardware acceleration, is usually faster than AES-GCM.[2]
History[edit]
The two building blocks of the construction, the algorithms Poly1305 and ChaCha20, were both independently designed, in 2005 and 2008, by Daniel J. Bernstein.[3][4]
In 2013–2014, a variant of the original ChaCha20 algorithm (using 32-bit counter and 96-bit nonce) and a variant of the original Poly1305 (authenticating 2 strings) were combined in an IETF draft[5][6] to be used in TLS and DTLS,[7] and chosen by Google, for security and performance reasons, as a newly supported cipher.[8]Shortly after Google's adoption for TLS, ChaCha20, Poly1305 and the combined AEAD mode are added to OpenSSH via the[email protected]authenticated encryption cipher[9][10] but kept the original 64-bit counter and 64-bit nonce for the ChaCha20 algorithm.
In 2015, the AEAD algorithm is standardized in RFC 7539[11] and RFC 7905[12] to be used in TLS 1.2 and DTLS 1.2 and in RFC 7634[13] to be used in IPsec. The same year, it is integrated in Cloudflare as an alternative ciphersuite.[14]
In June 2018, the RFC 7539 was updated and replaced by RFC 8439.[15]
Description[edit]
The ChaCha20-Poly1305 algorithm as described in RFC 8439[1] take as input a 256-bit key and a 96-bit nonce to encrypt a plaintext, with a ciphertext expansion of 128-bit (the tag size). In the ChaCha20-Poly1305 construction, ChaCha20 is used in counter mode to derive a key stream that is XORed with the plaintext. The ciphertext and the associated data is then authenticated using a variant of Poly1305 that first encodes the two strings into one.
Variants[edit]
XChaCha20-Poly1305 – extended nonce variant[edit]
The XChaCha20-Poly1305 construction is an extended 192-bit nonce variant of the ChaCha20-Poly1305 construction, using XChaCha20 instead of ChaCha20. When choosing nonces at random, the XChaCha20-Poly1305 construction allows for better security than the original construction. The draft attempt to standardize the construction expired in July 2020.[16]
Salsa20-Poly1305 and XSalsa20-Poly1305[edit]
Salsa20-Poly1305 and XSalsa20-Poly1305 are variants of the ChaCha20-Poly1305 and XChaCha20-Poly1305 algorithms, using Salsa20 and XSalsa20 in place of ChaCha20 and XChaCha20. They are implemented in NaCl[17] and libsodium[18] but not standardized. The variants using ChaCha is preferred in practice as it provides better diffusion per round than Salsa.[3]
Use[edit]
ChaCha20-Poly1305 is used in IPsec,[13] SSH,[9] TLS 1.2, DTLS 1.2, TLS 1.3,[12] QUIC,[19] WireGuard,[20] S/MIME 4.0,[21] OTRv4[22] and multiple other protocols. Among others, it is implemented in OpenSSL, OpenSSH and libsodium.
Performance[edit]
ChaCha20-Poly1305 usually offers better performance than the more prevalent AES-GCM algorithm on systems where the CPU(s) does not feature the AES-NI instruction set extension.[2] As a result, ChaCha20-Poly1305 is sometimes preferred over AES-GCM due to its similar levels of security and in certain use cases involving mobile devices, which mostly use ARM-based CPUs.
Security[edit]
The ChaCha20-Poly1305 construction is proven secure in the standard model and the ideal permutation model, for the single- and multi-user setting.[23] However, similarly to GCM, the security relies on choosing a unique nonce for every message encrypted. Compared to AES-GCM, implementations of ChaCha20-Poly1305 are less vulnerable to timing attacks.
See also[edit]
和AES GCM的对比：TODO
标签：Poly1305,edit,RFC,ChaCha20,construction,bit From： https://www.cnblogs.com/saaspeter/p/17048367.html