EVP_CHACHA20(3)

💖 EVP_CHACHA20(3) 💖

okay so bestie, this is a page from the Library Functions Manual for libcrypto, and it's literally the ChaCha20 stream cipher for EVP. grab a strawberry drink 🍓 and let's get into it.

✨ NAME ✨

EVP_chacha20, EVP_chacha20_poly1305 — ChaCha20 stream cipher for EVP 🌀

🌸 SYNOPSIS 🌸

it lives in library “libcrypto”, and yeah you gotta include the header:

#include <openssl/evp.h>

const EVP_CIPHER *
EVP_chacha20(void);

const EVP_CIPHER *
EVP_chacha20_poly1305(void);

🦋 DESCRIPTION 🦋

the plain ChaCha20 one 💅

EVP_chacha20() provides the ChaCha20 stream cipher in the EVP framework. EVP_EncryptInit_ex(3), EVP_DecryptInit_ex(3), and EVP_CipherInit_ex(3) take a key argument of 32 bytes = 256 bits and an iv argument of 16 bytes = 128 bits, internally using ChaCha_set_key(3) and ChaCha_set_iv(3). the lower 8 bytes = 64 bits of iv are used as counter and the remaining 8 bytes are used as the initialization vector of ChaCha_set_iv(3). ngl that split is a whole vibe. EVP_EncryptUpdate(3), EVP_EncryptFinal_ex(3), EVP_DecryptUpdate(3), and EVP_DecryptFinal_ex(3) internally use ChaCha(3) to perform encryption and decryption. and EVP_CIPHER_CTX_ctrl(3) always fails for ctx objects created from EVP_chacha20() — not me being dramatic, it literally always fails 💀

the poly1305 one, iykyk 🔥

EVP_chacha20_poly1305() provides authenticated encryption with ChaCha20-Poly1305. unless compatibility with other implementations like OpenSSL or BoringSSL is required, using EVP_AEAD_CTX_init(3) with EVP_aead_chacha20_poly1305(3) is recommended instead because the code then becomes transparent to the AEAD cipher used, more flexible, and less error prone. like, it's giving glow-up ✨

with EVP_chacha20_poly1305(), EVP_EncryptInit_ex(3), EVP_DecryptInit_ex(3), and EVP_CipherInit_ex(3) take a key argument of 32 bytes = 256 bits and an iv argument of 12 bytes = 96 bits. this supports additional authenticated data (AAD) and produces a 128-bit authentication tag. the constant EVP_CHACHAPOLY_TLS_TAG_LEN specifies the length of the authentication tag in bytes and has a value of 16 👑

the type arguments for EVP_CIPHER_CTX_ctrl(3) 🎀

these are the supported ones, one bullet each because we're organized like that:

• EVP_CTRL_AEAD_GET_TAG — copy the number of bytes indicated by the arg argument from the tag to the location indicated by the ptr argument; to be called after EVP_EncryptFinal_ex(3). this control operation fails if the ctx is not configured for encryption or if arg is less than 1 or greater than 16.
• EVP_CTRL_AEAD_SET_TAG — copy the number of bytes indicated by the arg argument from the location indicated by the ptr argument and designate them as the expected tag length and tag, causing subsequent EVP_DecryptFinal_ex(3) to fail if the tag calculated during decryption does not match. it is strongly recommended to specify arg as exactly 16. otherwise, only the initial part of the tag may be compared and mismatches near the end of the tag may get silently ignored 😭 this control operation fails if the ctx is configured for encryption or if arg is less than 1 or greater than 16. if the ptr argument is a NULL pointer, this control operation succeeds without having any effect.
• EVP_CTRL_AEAD_SET_IV_FIXED — set the initialization vector by reading the 12 bytes pointed to by the ptr argument, independently of EVP_EncryptInit_ex(3), EVP_DecryptInit_ex(3), and EVP_CipherInit_ex(3). this control operation fails if the arg argument is not exactly 12.
• EVP_CTRL_AEAD_SET_IVLEN — instruct subsequent EVP_EncryptInit_ex(3), EVP_DecryptInit_ex(3), or EVP_CipherInit_ex(3) to expect an iv argument shorter than the default of 12 bytes; the arg argument specifies the number of bytes to be used. the initialization functions will only read the specified smaller number of bytes from iv and internally zero-pad them on the left. using this is not recommended because it is likely more fragile and less often tested than the equivalent method of simply providing a full-sized iv. this control operation fails if arg is less than 1 or greater than 16.
• EVP_CTRL_INIT — set the length of the initialization vector to the default value of 12 bytes and clear the Poly1305 internal state. the application program usually does not need to invoke this control operation manually because it is automatically called internally by EVP_EncryptInit_ex(3), EVP_DecryptInit_ex(3), and EVP_CipherInit_ex(3). so like, it's handled, bestie 🫶

---

💜 RETURN VALUES 💜

EVP_chacha20() and EVP_chacha20_poly1305() return pointers to static EVP_CIPHER objects that contain the implementations of the symmetric cipher.

if ctx was created from EVP_chacha20() or EVP_chacha20_poly1305(), EVP_CIPHER_CTX_ctrl(3) returns 1 for success or 0 for failure. simple as 🌈

🌸 SEE ALSO 🌸

ChaCha(3), evp(3), EVP_aead_chacha20_poly1305(3), EVP_CIPHER_meth_new(3), EVP_EncryptInit(3) — go read these next, fr fr 📚

⭐ STANDARDS ⭐

A. Langley, W. Chang, N. Mavrogiannopoulos, J. Strombergson, and S. Josefsson, ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS), RFC 7905, June 2016.

🧚 HISTORY 🧚

EVP_chacha20() first appeared in OpenBSD 5.6.

EVP_chacha20_poly1305() first appeared in OpenSSL 1.1.0 and has been available since OpenBSD 7.2.

🙈 CAVEATS 🙈

okay so the original publications and code by Adam Langley used a modified AEAD construction that is incompatible with the common style used by AEAD in TLS and incompatible with RFC 7905:

A. Langley and W. Chang, ChaCha20 and Poly1305 based Cipher Suites for TLS, draft-agl-tls-chacha20poly1305-04, November 2013.

Y. Nir and A. Langley, ChaCha20 and Poly1305 for IETF Protocols, RFC 8439, May 2018.

in particular, the original version used a nonce of 8 instead of 12 bytes. ⚠️

---

🫶 cute little sign-off: this slay of a page is from Debian, dated June 8, 2025, and the whole thing is filed under EVP_CHACHA20(3). periodt. 💅✨