# Tag Info

### What's the appeal of using ChaCha20 instead of AES?

I believe there are three main reasons why ChaCha20 is sometimes preferred to AES. On a general-purpose 32-bit (or greater) CPU without dedicated instructions, ChaCha20 is generally faster than AES. ...
• 6,369

### What's the appeal of using ChaCha20 instead of AES?

Unless we find information from Google - such as white papers & mailinglist posts - we can only speculate why ChaCha20 is chosen. I think that efficient software implementation is still the most ...
• 85.8k

### What should the nonce value be for client-side encryption?

The library uses XChaCha20Poly1305 and that requires a nonce of 192-bit (24-byte). It is an extension of ChaCha20Poly1305 to increase the nonce size, ChaCha20 had ...
• 43.5k

### What's the appeal of using ChaCha20 instead of AES?

Quoting RFC 8439 (emphasis mine): The Advanced Encryption Standard (AES — [FIPS-197]) has become the gold standard in encryption. Its efficient design, widespread implementation, and hardware ...
• 231
Accepted

### Is it safe to use a random numbers instead of a counter in ChaCha20?

I am using here the description and terminology from RFC 7539. ChaCha20 is meant to process messages, each message being a sequence of bytes; ChaCha20 produces pseudorandom blocks of 64 bytes each, ...
• 84.8k
Accepted

### Why is the core ChaCha primitive not good for use in a CRCF? Why create BLAKE?

I'm answering the following which was asked in the original question: Why is stock chacha20 not good as a cryptographic hash? Why create BLAKE? Why not simply apply the one-way compression function ...
• 7,266

### Where are the ChaCha20 test vectors/examples?

There are in the RFC : https://datatracker.ietf.org/doc/html/draft-agl-tls-chacha20poly1305-04#section-7 The following blocks contain test vectors for ChaCha20. The first line contains the 256-...
• 407
Accepted

### Why should one prefer Salsa20 over ChaCha?

I agree that conservatism is the likely reason for the choice in McBits. ChaCha was published while eSTREAM was still running. Salsa20/12 is now in the final eSTREAM portfolio. Even in the XSalsa ...
• 31.3k
Accepted

### Nonce encryption with Poly1305-Chacha20

Do all TLS cipher suites using "ChaCha20-Poly1305" use Poly1305-AES? Nope, AES is indeed replaced with ChaCha20 in TLS. The Poly1305 one-time key is generated pseudorandomly using the ...
• 2,704
Accepted

### Is ChaCha20 alone sufficient for securing data-at-rest?

You really don't want to use ChaCha20 alone in (nearly) any situation. What ChaCha20 does for you is to prevent attackers from (passively) reading your data, which is good. But ChaCha is a so-called ...
• 44.7k
Accepted

### What happens if a nonce is reused in ChaCha20-Poly1305?

If you reuse a nonce, you lose confidentiality for the messages with that nonce. Messages with other nonces retain their confidentiality. However, the attacker can also attack the MAC part (Poly1305) ...
• 31.3k
Accepted

### Can reduced-round ChaCha be used as non-cryptographic fast PRNG to produce output indistinguishable from random data?

As cypherfox had correctly pointed out during our chat, two rounds is not enough to reliably diffuse a single changed bit throughout the entire output. My question appears to have been answered ...
• 13.5k
Accepted

### Does ChaCha20-Poly1305 need random nonce?

No, it doesn't need a random nonce. Yes, if you use an incrementing counter, that works. As the RFC says, the only requirement is uniqueness; as long as you make sure that each nonce you use is ...
• 133k