18.5 ChaCha20-Poly1305 AEAD construction
ChaCha20-Poly1305 is a cryptographic algorithm for authenticated encryption with additional data (AEAD, see Chapter 15, Authenticated Encryption). Like the two building blocks ChaCha20 and Poly1305, ChaCha20-Poly1305 used in TLS is defined in RFC 8439 [131]. Initially, both building blocks were proposed by the American cryptographer Dan Bernstein [25, 23].
The ChaCha20-Poly1305 AEAD construction is illustrated in Figure 18.3. As you can see, the algorithm takes four inputs:
A 256-bit shared secret key k
A 96-bit nonce n, which must be different for each ChaCha20-Poly1305 algorithm invocation with the same key
A plaintext p of arbitrary size
Arbitrary-sized additional authenticated data d
In the first step, the Poly1305 one-time key kot is generated using the ChaCha20 block function B as described in Algorithm 10.
In the second step, the ChaCha20 encryption process C, discussed previously in this chapter and illustrated...
