ChaCha20 stream cipher and ChaCha20-Poly1305 AEAD.

ChaCha20 is a fast, secure stream cipher designed by Daniel J. Bernstein. It is widely used in TLS 1.3 and WireGuard as an alternative to AES when hardware AES acceleration is unavailable.

• ChaCha20 (stream) - symmetric stream cipher; keystream is XOR'd with the plaintext. No authentication; pair with an HMAC if you need it, or use the Poly1305 variant.
• ChaCha20-Poly1305 - authenticated encryption (AEAD) combining ChaCha20 with the Poly1305 MAC. This is the recommended variant.

Key: 32 bytes. Nonce: 12 bytes. Counter starts at 0.

local chacha20 = require("@eryx/crypto/hazmat/chacha20")

local key   = buffer.create(32)  -- 32 zero bytes (use a real key!)
local nonce = buffer.create(12)  -- 12 zero bytes

-- Authenticated encryption
local enc = chacha20.new(key, "poly1305", "encrypt", nonce)
local ct = enc:update(buffer.fromstring("secret"))
local tail = enc:final()
local tag = enc:getTag()

local dec = chacha20.new(key, "poly1305", "decrypt", nonce)
dec:setTag(tag)
local pt = dec:update(ct)
local ptTail = dec:final()

Summary

Classes

Functions

API Reference

Classes

Context

Properties

Context:update

Context:update(data: buffer) → buffer

Context:updateAAD

Context:updateAAD(aad: buffer) → ()

Context:setTag

Context:setTag(tag: buffer) → ()

Context:getTag

Context:getTag() → buffer

Context:final

Context:final() → buffer

Context:close

Context:close() → ()

Functions

chacha20.new

Creates a streaming ChaCha20 context.

For stream, the nonce must be 12 bytes and the context behaves like a raw stream cipher with no authentication. For poly1305, the nonce must also be 12 bytes and you can use Context.updateAAD, Context.setTag, and Context.getTag for AEAD operation.

chacha20.new(key: buffer, mode: Mode, operation: Operation, nonce: buffer) → Context

Parameters

key: buffer

32-byte ChaCha20 key.

mode: Mode

"stream" or "poly1305".

operation: Operation

"encrypt" or "decrypt".

nonce: buffer

12-byte nonce.

Returns

Context

Streaming ChaCha20 context.

Types

Mode

type Mode = "stream" | "poly1305"

Operation

type Operation = "encrypt" | "decrypt"