Doing some lecture to choose a good configuration for my SSL certificate for my website (using a regular LAMP configuration), I'm wondering what are the possibles and secure alternative to poly1305 using the ChaCha20 stream cipher ?

And why I can't heard of ChaCha20 without Poly1305 ?

  • They were meant to be used together: tools.ietf.org/html/rfc7539 – schroeder Jul 26 '16 at 17:16
  • And why not another stuff for data integrity ? Why I'm forced to use Poly1305 ? Can ChaCha20 be used with something else but nobody have implemented it ? Can I use Salsa20 then ? – NSA Jul 26 '16 at 18:47

ChaCha20 and Salsa20 are stream ciphers. Their purpose is to provide confidentiality, as long as the key used to seed them remains secret. Poly1305 however is a Message Authentication Code (MAC), which is supposed to provide integrity and authenticity for the sent messages.

In general, it should be possible to use them separately as they do not seem to depend on each other (Poly1305 can, and does as far as TLS is concerned, use ChaCha20 as an underlying cipher, however). For example, the NaCl crypto library lets you do encryption using Salsa20, authentication using Poly1305 or authenticated encryption using both schemes.

However, it is not possible to use them separately with TLS. The reason for this is, that TLS uses a scheme to identify the combinations of Key Exchange Algorithm/Cipher/MAC called "Cipher Suites". As a client always sends all the cipher suites it supports in each "Client Hello" packet (the first packet needed to establish a TLS connection), all possible cipher suites are predefined, so a 2-byte ID is sufficient to represent a single cipher suite.

As RFC7539 states, the main reasons for including the possibility to use ChaCha20 and Poly1305 are to have an alternative to AES in case weaknesses are found and to have a fast alternative to use on slow hardware [Page 2].

You can see all the defined cipher suites and their representations at IANA's TLS parameter specification. Alternatively, have a look at RFC7539 (link at schroeder's comment to your post), which specifies all possible cipher suites using ChaCha/Poly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.