ChaCha20-Poly1305.

ChaCha20-Poly1305 is the AEAD cipher specified in RFC 8439 (which obsoleted RFC 7539). ChaCha20 is a 256-bit-key ARX stream cipher designed by Daniel J. Bernstein, with a 96-bit nonce and 32-bit counter producing a 512-bit keystream block per invocation; Poly1305 is a 128-bit one-time MAC over the ciphertext and associated data, keyed by the first block of the ChaCha20 keystream. Because it is constant-time and fast in pure software without AES-NI, Google shipped it in Chrome and Android in 2014 (championed by Adam Langley) to protect mobile clients lacking AES hardware, where it sidesteps the cache-timing pitfalls of table-based AES.

It is now ubiquitous: TLS 1.2 suites (RFC 7905), a mandatory TLS 1.3 suite (RFC 8446), QUIC (RFC 9001), chacha20-poly1305@openssh.com in OpenSSH since 6.5, OpenVPN, and every WireGuard data frame. The extended-nonce variant XChaCha20-Poly1305 (192-bit nonce, popularised by libsodium) lets applications choose nonces randomly without birthday-bound concerns.

Like AES-GCM it fails catastrophically on nonce reuse: repeating a nonce under one key both leaks the keystream XOR of two plaintexts and exposes the Poly1305 key, enabling message forgery. Implementations therefore use deterministic counters and rekey before the counter can wrap.

flowchart LR
  K[256-bit key] --> CC[ChaCha20]
  N[96-bit nonce] --> CC
  CC -->|block 0| PK[Poly1305 one-time key]
  CC -->|blocks 1..n| KS[Keystream]
  P[Plaintext] --> X((XOR))
  KS --> X
  X --> CT[Ciphertext]
  AD[Associated data] --> PM[Poly1305 MAC]
  CT --> PM
  PK --> PM
  PM --> TAG[128-bit tag]
  CT --> OUT[Ciphertext + tag]
  TAG --> OUT