The ChaCha Stream Cipher for Transport Layer Security

This document describes the use of the ChaCha stream cipher in the Transport Layer Security (TLS) version 1.0 , TLS version 1.1 , and TLS version 1.2 protocols, as well as in the Datagram Transport Layer Security (DTLS) versions 1.0 and 1.2 . It can also be used with Secure Sockets Layer (SSL) version 3.0 . ChaCha is a stream cipher that has been designed for high performance in software implementations. The cipher has compact implementation and uses few resources and inexpensive operations that makes it suitable for implementation on a wide range of architectures. It has been designed to prevent leakage of information through side channel analysis, has a simple and fast key setup and provides good overall performance. It is a variant of Salsa20 which is one of the selected ciphers in the eSTREAM portfolio . Recent attacks have indicated problems with CBC-mode cipher suites in TLS and DTLS as well as issues with the only supported stream cipher (RC4) . While the existing AEAD (AES-GCM) ciphersuites address some of these issues, concerns about the performance and ease of software implementation are sometimes raised. Therefore, a new stream cipher to replace RC4 and address all the previous issues is needed. It is the purpose of this document to describe a secure stream cipher for both TLS and DTLS that is comparable to RC4 in speed on a wide range of platforms and can be implemented easily without being vulnerable to software side-channel attacks.

ChaCha is a stream cipher developed by D. J. Bernstein in 2008. It is a refinement of Salsa20 and was used as the core of the SHA-3 finalist, BLAKE. The variant of ChaCha used in this document is ChaCha with 20 rounds, a 96-bit nonce and a 256 bit key, which will be referred to as ChaCha20 in the rest of this document. This is the conservative variant (with respect to security) of the ChaCha family and is described in .

Poly1305 is a Wegman-Carter, one-time authenticator designed by D. J. Bernstein. Poly1305 takes a 32-byte, one-time key and a message and produces a 16-byte tag that authenticates the message such that an attacker has a negligible chance of producing a valid tag for an inauthentic message. It is described in .

In the next sections different ciphersuites are defined that utilize the ChaCha20 cipher combined with various message authentication methods. In all cases, the ChaCha20 cipher, as in , uses a 96-bit nonce. That nonce is updated on the encryption of every TLS record, and is formed as follows.

The salt is generated as part of the handshake process. It is either the client_write_IV (when the client is sending) or the server_write_IV (when the server is sending). The salt length (SecurityParameters.fixed_iv_length) is 4 bytes. The record_counter is the 64-bit TLS record sequence number. In case of DTLS the record_counter is formed as the concatenation of the 16-bit epoch with the 48-bit sequence number. In both TLS and DTLS the ChaChaNonce is implicit and not sent as part of the packet. The pseudorandom function (PRF) for TLS 1.2 is the TLS PRF with SHA-256 as the hash function. When used with TLS versions prior to 1.2, the PRF is calculated as specified in the appropriate version of the TLS specification. The RSA, DHE_RSA, ECDHE_RSA, ECDHE_ECDSA, PSK, DHE_PSK, RSA_PSK, ECDHE_PSK key exchanges are performed as defined in , , and .

The following CipherSuites are defined.

The MAC algorithm used in the ciphersuites above is HMAC-SHA1 .

The ChaCha20 and Poly1305 primitives are built into an AEAD algorithm, AEAD_CHACHA20_POLY1305, described in . It takes as input a 256-bit key and a 96-bit nonce. When used in TLS, the record_iv_length is zero and the nonce is set to be the ChaChaNonce. The additional data is seq_num + TLSCompressed.type + TLSCompressed.version + TLSCompressed.length, where "+" denotes concatenation. The following CipherSuites are defined.

The ChaCha20 ciphersuites with HMAC-SHA1 defined in this document differ from the TLS RC4 ciphersuites that have been the basis for the definition of Standard Stream Cipher. Unlike RC4, ChaCha20 requires a nonce per record. This however, does not affect the description of the Standard Stream Cipher if one assumes that a nonce is optional and depends on the cipher's characteristics. Hence, this document modifies the Standard Stream Cipher by adding an implicit nonce. The implicit nonce may consist of an optional fixed component ("salt"), generated from the key_block; a variable component, based on the 64-bit TLS record sequence number or the concatenation of the 16-bit epoch with the 48-bit sequence number in case of DTLS. Stream ciphers that don't require a nonce such as RC4 shall ignore it. Other stream ciphers that require a nonce, such as ChaCha20 with HMAC-SHA1, will use the nonce and reset their state on each record.

The DTLS protocol requires the cipher in use to introduce no dependencies between TLS Records to allow lost or rearranged records. For that it explicitly bans stream ciphers (see Section 3.1 of ). As the stream cipher described in this document, unlike RC4, does not require dependencies between records, this ban of stream ciphers is lifted with this document. Stream ciphers can be used with DTLS if they introduce no dependencies between records.

The authors would like to thank Zooko Wilcox-OHearn and Samuel Neves.

IANA is requested to assign the following Cipher Suites in the TLS Cipher Suite Registry:

ChaCha20 follows the same basic principle as Salsa20, a cipher with significant security review . At the time of writing this document, there are no known significant security problems with either cipher, and ChaCha20 is shown to be more resistant in certain attacks than Salsa20 . Furthermore ChaCha20 was used as the core of the BLAKE hash function, a SHA3 finalist, that had received considerable cryptanalytic attention . Poly1305 is designed to ensure that forged messages are rejected with a probability of 1-(n/2^102) for a 16*n byte message, even after sending 2^64 legitimate messages. The cipher suites described in this document require that an nonce is never repeated under the same key. The design presented ensures that by using the TLS sequence number which is unique and does not wrap . This document should not introduce any other security considerations than those that directly follow from the use of the stream cipher ChaCha20, the AEAD_CHACHA20_POLY1305 construction, and those that directly follow from introducing any set of stream cipher suites into TLS and DTLS (see also the Security Considerations section of ).