🌊 ChaCha20 and Stream Ciphers
The mobile-friendly alternative to AES⏱ ~2 min
Why ChaCha20 Exists
AES requires hardware acceleration (AES-NI instructions) to be fast. On low-power devices — older phones, embedded systems, IoT devices — AES without hardware support is slow and drains battery. ChaCha20 was designed by Daniel J. Bernstein to be fast in pure software, with no hardware acceleration needed.
| Property | AES-GCM | ChaCha20-Poly1305 |
|---|---|---|
| Performance (hardware) | Extremely fast with AES-NI | Slightly slower than AES-NI |
| Performance (no hardware) | Slow — software-only AES is sluggish | Fast — designed for software |
| Security | No known practical attack | No known practical attack |
| Authentication | GCM tag (AEAD) | Poly1305 tag (AEAD) |
| Key size | 128 or 256 bits | 256 bits only |
| Nonce size | 96 bits (12 bytes) | 96 bits (12 bytes) |
| Used in | TLS, disk encryption, VPNs | TLS 1.3, WireGuard, Signal |
How ChaCha20 Works
ChaCha20 is a stream cipher based on a 512-bit state — a 4×4 matrix of 32-bit words populated with the 256-bit key, a 64-bit counter, a 96-bit nonce, and a constant. The state is scrambled through 20 rounds of 'quarter-round' operations (hence the 20 in the name) and added to the original state to produce a 512-bit keystream block. Each counter value produces a unique keystream block — the counter ensures the keystream never repeats.
When is ChaCha20 preferred over AES?