ChaCha20-Poly1305
An AEAD that combines the ChaCha20 stream cipher with the Poly1305 authenticator (RFC 8439). It is fast in software on hardware without AES instructions and, like AES-GCM, must never reuse a 96-bit nonce under one key; XChaCha20-Poly1305 extends the nonce to 192 bits so that random nonces are safe.
- Also called
- XChaCha20-Poly1305
- Defined in
- RFC 8439
Covered in
AEAD records: AES-GCM nonces, associated data and key limits
Build an encrypted record whose tag binds ciphertext to the intended tenant, record, purpose and format, keep nonces unique within each key’s usage limit, and verify the design with actual AES-GCM.
Choose cryptographic algorithms and parameters by job
A sourced quick reference for October 2026: which algorithm and parameters to use for encryption, hashing, passwords, MACs, signatures, key agreement, key derivation, randomness and TLS, the matching APIs in Node.js, Python, Java, Go and .NET, and where post-quantum migration stands.
Practice: AES-GCM nonce reuse lab: Fix a nonce allocator that breaks after restart · Insecure randomness lab: Generate unguessable API keys · Local project: Bind ciphertext to the correct record