ChaCha20.

ChaCha20 is a 20-round stream cipher designed by Daniel J. Bernstein in 2008 as a refinement of his Salsa20 design. It produces a keystream from a 256-bit key, a 96-bit nonce, and a 32-bit block counter using only add-rotate-xor (ARX) operations on 32-bit words — a "quarter-round" mixing four state words at a time. Because it needs no lookup tables, it is fast and naturally constant-time on CPUs without AES hardware, which is why Google first deployed it in 2014 to protect Android and Chrome traffic. Combined with the Poly1305 MAC, the AEAD scheme ChaCha20-Poly1305 is standardized in RFC 8439 (which obsoleted RFC 7539) and is one of the two mandatory cipher suites in TLS 1.3, alongside AES-GCM. It also underpins QUIC, WireGuard, OpenSSH, the Signal Protocol, and the Linux kernel RNG.

The critical operational pitfall is nonce reuse: encrypting two messages with the same key and nonce exposes the XOR of their plaintexts and reveals the one-time Poly1305 key, breaking both confidentiality and authenticity. The 96-bit nonce is comfortable for a per-connection counter but risky for random generation at scale, so XChaCha20 (draft-irtf-cfrg-xchacha) extends the nonce to 192 bits via an HChaCha20 subkey derivation, making random nonces safe. After more than a decade of cryptanalysis, no attack breaks the full 20-round cipher.

flowchart LR
  K[256-bit key] --> S[Initialize state: constants, key, counter, nonce]
  N[96-bit nonce] --> S
  CTR[Block counter] --> S
  S --> R[20 rounds of ARX quarter-rounds]
  R --> KS[Keystream block]
  PT[Plaintext] --> X((XOR))
  KS --> X
  X --> CT[Ciphertext]
  CT --> P[Poly1305 MAC]
  P --> TAG[Authentication tag]