.jpg)
 |
| Img Src: Claude AI |
When we talk about encryption, most of us have probably heard about AES. But there is another encryption algorithm that is widely used in modern security protocols, especially when software performance matters - ChaCha20. If you have worked with TLS, VPNs, SSH, mobile applications, or modern networking, you may have already encountered ChaCha20-Poly1305.
But what exactly is ChaCha20? Why do we need it when AES already exists? And what makes it useful in modern systems?
Let's understand it in a simple way.
What is ChaCha20?
ChaCha20 is a stream cipher designed by Daniel J. Bernstein. It is based on the Salsa20 family of stream ciphers.
The number 20 in ChaCha20 represents the number of rounds used by the algorithm.
The IETF version of ChaCha20 uses a 256-bit key, a 96-bit nonce, a block counter, and 20 rounds of cryptographic operations.
Unlike encryption algorithms that operate on fixed-size blocks, ChaCha20 generates a stream of pseudorandom data called a keystream. The plaintext is then combined with this keystream using XOR to produce ciphertext.
Conceptually, it looks something like this:
Plaintext
+
Keystream
|
XOR
|
v
Ciphertext
The interesting part is that the keystream looks completely random to someone who does not have the correct key.
Why is it called a Stream Cipher?
To understand ChaCha20 properly, we need to understand the difference between a block cipher and a stream cipher.
A block cipher such as AES processes data in fixed-size blocks. A stream cipher, on the other hand, generates a stream of pseudorandom bits or bytes and combines that stream with the original data.
Think about it like this.
If our original message is:
Hello from Nepal
ChaCha20 generates a cryptographic keystream. The message and keystream are combined using XOR, resulting in ciphertext.
The actual values are not this simple, but conceptually:
Plaintext + Keystream = Ciphertext
During decryption, the same keystream is generated again and XORed with the ciphertext to recover the original plaintext.
What is inside ChaCha20?
ChaCha20 uses a 512-bit internal state.
This state consists of sixteen 32-bit words.
Conceptually, the state contains:
- Constants
- A 256-bit key
- A block counter
- A 96-bit nonce
The algorithm then performs a series of transformations on this state.
These transformations are based on three simple operations:
- Addition
- XOR
- Bit rotation
This combination is commonly referred to as ARX cryptography.
ARX stands for:
A = Addition R = Rotation X = XOR
And this is one of the interesting characteristics of ChaCha20. It relies heavily on operations that are efficient on general-purpose CPUs.
Why 20 Rounds?
The ChaCha20 algorithm performs 20 rounds of its core transformation.
These rounds are based around an operation called the quarter round.
The transformations are performed across the internal state using column and diagonal operations.
In simplified form:
Column Round
↓
Diagonal Round
↓
Column Round
↓
Diagonal Round
↓
...
↓
20 Rounds
Each round increases the diffusion of the input data, making the resulting output increasingly difficult to predict without knowing the key.
What is the 256-bit Key?
ChaCha20 uses a 256-bit key.
That means the key contains:
256 bits = 32 bytes
The encryption key is secret. Anyone who obtains the key may be able to decrypt the protected data, depending on how the protocol is implemented.
This is why cryptographic keys should never be hard-coded into source code or stored inside a public Git repository.
For example, something like this would be a bad idea:
const key = "my-secret-encryption-key";
Instead, keys should be securely managed using appropriate secret-management mechanisms.
What is a Nonce?
Now we come to one of the most important concepts in ChaCha20 - the nonce.
Nonce basically means a number used once.
The IETF version of ChaCha20 uses a 96-bit nonce.
The nonce does not have to be secret. However, when using the same key, it must be unique for each encryption operation.
For example:
Key = SECRET_KEY Message 1 → Nonce A Message 2 → Nonce B Message 3 → Nonce C Message 4 → Nonce D
But doing this with the same key is dangerous:
Message 1 → Nonce A Message 2 → Nonce A
Reusing a nonce with the same key can seriously compromise the security of the encryption scheme.
This is an important lesson in cryptography:
A nonce does not necessarily need to be secret. It needs to be unique.
ChaCha20 vs ChaCha20-Poly1305
You may have noticed that in real-world applications we often see ChaCha20-Poly1305 rather than simply ChaCha20.
There is a reason for that.
ChaCha20 provides encryption, or in cryptographic terms, confidentiality.
But encryption alone does not necessarily tell us whether someone has modified the encrypted data.
This is where Poly1305 comes in.
Poly1305 is a message authentication code that provides authentication and integrity protection.
So conceptually:
ChaCha20 ↓ Confidentiality Poly1305 ↓ Integrity + Authentication
When combined together, they form an AEAD construction.
AEAD stands for Authenticated Encryption with Associated Data.
So instead of simply getting encrypted data, we also get an authentication tag that allows the receiver to verify that the protected data has not been modified.
Why do we need ChaCha20 if AES already exists?
This is probably the question most people ask.
If AES is already widely used and extremely secure, why do we need another encryption algorithm?
The answer is mainly related to performance and hardware.
AES can be extremely fast when the processor provides dedicated hardware acceleration such as AES-NI.
But not every device has the same hardware capabilities.
ChaCha20 was designed to perform very efficiently using common software operations such as addition, XOR, and bit rotation.
This makes it particularly attractive on systems where hardware-accelerated AES is unavailable or less efficient.
So I wouldn't look at the comparison like this:
AES = Bad ChaCha20 = Good
That would be completely wrong.
A better way to look at it is:
AES | +-- Very widely deployed | +-- Excellent performance with hardware acceleration ChaCha20 | +-- Excellent software performance | +-- Useful when AES hardware acceleration is unavailable
Both are important modern cryptographic algorithms.
Where is ChaCha20 used?
ChaCha20-Poly1305 is not just a theoretical cryptographic algorithm.
It is used in real-world security protocols and applications.
You can encounter ChaCha20-Poly1305 in technologies involving:
- TLS
- VPNs
- Network security
- Mobile applications
- Modern cryptographic libraries
- Other secure communication protocols
So when we are working with modern infrastructure and secure network communication, there is a good chance that ChaCha20 is somewhere in the stack.
How does ChaCha20 encryption actually work?
Let's simplify the complete process.
Suppose we want to encrypt:
Hello from Nepal!
We start with several pieces of information:
Key Nonce Counter Plaintext
ChaCha20 uses the key, nonce, and counter to generate a pseudorandom keystream.
The plaintext is then combined with this keystream using XOR.
Conceptually:
Plaintext
+
Keystream
|
XOR
|
v
Ciphertext
The receiver can perform the reverse operation using the same cryptographic parameters to recover the original plaintext.
When ChaCha20-Poly1305 is being used, Poly1305 also generates an authentication tag that allows the receiver to verify the integrity of the protected data.
The Most Important Security Rule
If you remember only one thing from this entire article, remember this:
Never reuse the same nonce with the same key.
A strong encryption algorithm does not automatically make an application secure.
You can have:
Strong Algorithm
+
Bad Implementation
=
Bad Security
This is something I see as one of the most important lessons in security.
Security is not only about choosing a strong algorithm. It is also about implementing and configuring that algorithm correctly.
Encryption is bigger than the algorithm
When we talk about encryption, we often focus on the algorithm itself.
But in a real production environment, there are many other things that matter.
Strong Encryption
+
Secure Key Management
+
Correct Nonce Handling
+
Authentication
+
Secure Protocol
+
Correct Implementation
+
Secure Configuration
=
Real Security
ChaCha20 is only one part of the complete security architecture.
That is why protocols such as TLS define much more than just which encryption algorithm should be used.
Final Thoughts
ChaCha20 might look complicated when we first encounter terms such as quarter rounds, ARX, nonces, counters, and Poly1305.
But if we simplify everything, the basic idea becomes much easier to understand.
ChaCha20 ↓ Stream Cipher ↓ 256-bit Key ↓ 96-bit Nonce ↓ 20 Rounds ↓ Keystream ↓ Encryption
And when we combine it with Poly1305:
ChaCha20 + Poly1305
↓
Authenticated Encryption
↓
Confidentiality + Integrity
What I personally find interesting about ChaCha20 is that it demonstrates how relatively simple operations such as addition, XOR, and bit rotation can be combined into a cryptographic construction capable of protecting real-world communication.
As a system administrator, I don't necessarily need to implement ChaCha20 myself.
But I should understand what is protecting my traffic, why a particular cipher is being used, and what can happen when something as simple as incorrect nonce management is implemented.
Because at the end of the day, security is not only about having strong tools. It is about using them correctly.
Stay tuned for more interesting stuff from the world of systems, networking, security, Linux, and infrastructure.
