I have read that in general stream ciphers do not provide data integrity. Can ChaCha20 be implemented in such a way (perhaps like counter mode with message authentication in AES) to provide this?


1 Answer 1


ChaCha20 has Ind-CPA security and beyond this ( Ind-CCAx.. [1]), you need integrity and authentication. And note that Authenticated Encryption > Ind-CCA.

ChaCha20 is already teamed with Poly1305 authenticator to provide confidentiality, integrity and authentication. It exists in TLS standards and one of the five cipher suites in TLS 1.3 as ChaCha20_Poly1305.

If you are going to use ChaCha20 it is better to use XChaCha20-Poly1305 since it has larger nonce sizes (192-bit) so that randomly generated nonces are safe against the collisions, you need $2^{96}$ random nonces to hit another one with 50% probability and that is almost impossible.

  • $\begingroup$ "You need $2^{96}$ random nonces to hit another one with 50% probability and that is almost impossible." I would just like to note that your most significant weakness was and still is a badly seeded RNG causing a collision in the nonce, e.g. at OS startup for some devices. $\endgroup$
    – orlp
    Mar 25, 2021 at 21:42
  • $\begingroup$ @orlp well, that is a general issue. One has to know about their system before going to use it for security, like this What issues are there while using Linux's /dev/urandom for generating cryptographic keys? $\endgroup$
    – kelalaka
    Mar 25, 2021 at 21:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.