ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS)
updates
Extracted elements (15)
ChaCha20 and Poly1305 were selected to replace RC4 and address CBC-mode vulnerabilities because they are designed for high-performance software implementations, require few resources and inexpensive operations, and minimize information leakage through side-channels. They provide a secure stream cipher comparable to RC4 in speed across a wide range of platforms.
The nonce is constructed from the record sequence number and shared secret (both known to the recipient), so no per-record explicit nonce is transmitted. This saves eight bytes per record and prevents implementations from mistakenly using a random nonce. This construction also matches the scheme expected for TLS 1.3.
The DHE_RSA, ECDHE_RSA, ECDHE_ECDSA, PSK, ECDHE_PSK, DHE_PSK, and RSA_PSK key exchange mechanisms for these cipher suites are unaltered and performed as defined in RFC 5246, RFC 4492, and RFC 5489 respectively.
The nonce construction for ChaCha20-Poly1305 in TLS differs from the explicit nonce construction used with AES-GCM in TLS 1.2 but matches the implicit nonce scheme expected to be used in TLS 1.3.
These cipher suites MUST only be used with TLS version 1.2 or later and DTLS version 1.2 or later, as the AEAD construction is integrated per Section 6.2.3.3 of RFC 5246.
ChaCha20 as used in this document has 20 rounds, a 96-bit nonce, and a 256-bit key (referred to as 'ChaCha20'). It is the conservative, high-security variant of the ChaCha family as specified in RFC 7539.
Poly1305 is a Wegman-Carter one-time authenticator that takes a 256-bit one-time key and a message and produces a 16-byte authentication tag. It is used together with ChaCha20 as the AEAD_CHACHA20_POLY1305 construction per RFC 7539.
Seven TLS cipher suites are defined using ChaCha20-Poly1305: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xA8), TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xA9), TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xAA), TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xAB), TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xAC), TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xAD), and TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xAE). All use SHA-256 as the PRF hash function.
IANA added seven entries to the TLS Cipher Suite Registry: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xA8), TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xA9), TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xAA), TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xAB), TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xAC), TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xAD), and TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 (0xCC,0xAE).
AEAD constructions such as ChaCha20-Poly1305 are not intended to hide plaintext lengths. Traffic analysis is outside the scope of the AEAD and is addressed elsewhere; the side-channel protections in scope are timing and cache side-channels only.
ChaCha20 is based on Salsa20, which has received significant security review. At the time of publication there are no known significant security problems with either cipher, and ChaCha20 is shown to be more resistant to certain attacks than Salsa20.
Poly1305 ensures forged messages are rejected with probability 1-(n/2^107) where n is the maximum input length; for (D)TLS this gives a maximum forgery probability of approximately 1 in 2^93.
The cipher suites require that a nonce never be repeated under the same key. This is ensured by using the TLS sequence number, which is unique and does not wrap per RFC 5246.
In DTLS, the 64-bit seq_num used for nonce construction is the 16-bit epoch concatenated with the 48-bit sequence_number.
The 96-bit nonce for AEAD_CHACHA20_POLY1305 in TLS is formed by serializing the 64-bit record sequence number as an 8-byte big-endian value, left-padding with four 0x00 bytes, then XORing with the sender's write_IV (client_write_IV or server_write_IV). SecurityParameters.fixed_iv_length is 12 bytes and SecurityParameters.record_iv_length is 0 bytes.