Do all TLS cipher suites using "ChaCha20-Poly1305" use Poly1305-AES?
Nope, AES is indeed replaced with ChaCha20 in TLS. The Poly1305 one-time key is generated pseudorandomly using the ChaCha20 block function. The ChaCha20-Poly1305 TLS cipher suite spec draft uses the AEAD construction from RFC 7539, which defines exactly how this works:
The ChaCha20 and Poly1305 primitives are combined into an AEAD that
takes a 256-bit key and 96-bit nonce as follows:
o First, a Poly1305 one-time key is generated from the 256-bit key
and nonce using the procedure described in Section 2.6.
and Section 2.6 describes how the block function is used to generate the key:
o The 256-bit session integrity key is used as the ChaCha20 key.
o The block counter is set to zero.
o The protocol will specify a 96-bit or 64-bit nonce. This MUST be
unique per invocation with the same key, so it MUST NOT be
Interestingly, the same 256-bit key and 96-bit nonce that are used to generate the one-time Poly1305 key are also used to produce the ChaCha20 keystream during the encryption step. This would be a security problem, except for this little detail:
o Next, the ChaCha20 encryption function is called to encrypt the
plaintext, using the same key and nonce, and with the initial
counter set to 1.
Essentially, the first block (block zero) of ChaCha20 keystream output is used as the Poly1305 one-time key, while the remaining blocks are used in the actual encryption. This is critical: without this separation, an attacker could determine the Poly1305 key.
You might wonder why the Poly1305 paper used AES in the first place. Poly1305 was published in 2005, around the same time Salsa20 (ChaCha20's predecessor) was introduced. I suspect Bernstein chose AES since it was considered the "gold standard" at the time, and Salsa20 had not yet received significant attention from cryptanalysts.