Do the ChaCha: better mobile performance with cryptography (2024)

Loading...

Do the ChaCha: better mobile performance with cryptography (2)
CC BY-ND 2.0 image image by Clinton Steeds

CloudFlare is always trying to improve customer experience by adopting the latest and best web technologies so that our customers (and their visitors) have a fast and a secure web browsing experience.

More and more web sites are now using HTTPS by default. This sea change has been spearheaded by many groups including CloudFlare enabling free SSL for millions of sites with Universal SSL, Google moving towards marking plain HTTP as insecure in Chrome, and the Let’s Encrypt project’s plans to make certificates free in 2015.

Not only is the encrypted web more secure, it can also be faster than the unencrypted web if the latest HTTPS features are implemented. HTTPS sites are blazing fast on CloudFlare because we keep up with the latest performance-enhancing features:

  • SPDY 3.1 is on by default for all customers. SPDY enables faster-than-HTTP download speeds by enabling multiplexing
  • OCSP stapling: faster revocation checking.
  • Optimized certificate bundles using CFSSL, our open source SSL bundler: an optimized certificate chain provides faster validation of certificates in the browser
  • ECDSA certificates for all free customers with Universal SSL: smaller certificates with smaller keys result in faster connection establishment times
  • Global session ticket resumption for faster session resumptions on globally load balanced servers: connections to sites you have already visited are jump-started requiring one less round-trip to resume

Today we are adding a new feature — actually a new form of encryption — that improves mobile performance: ChaCha20-Poly1305 cipher suites. Until today, Google services were the only major sites on the Internet that supported this new algorithm. Now all sites on CloudFlare support it, too. This means mobile browsers get a better experience when visiting sites using CloudFlare.

As of the launch today (February 23, 2015), nearly 10% of https connections to CloudFlare use the new ciphersuites. The following graph shows the uptick when we turned ChaCha20/Poly1305 on globally:

Do the ChaCha: better mobile performance with cryptography (3)

TLS to the max

The protocol for encrypting HTTPS connections is called Transport Layer Security (TLS). One of the nice features of TLS is that new encryption algorithms or ciphers can be proposed and added to the specification.

As we described in our introduction to TLS, there are several components to a TLS cipher suite. There is one algorithm for each of the following:

  • key establishment (typically a Diffie-Hellman variant or RSA)
  • authentication (the certificate type)
  • confidentiality (a symmetric cipher)
  • integrity (a hash function)

The new cipher suites we have added include a new symmetric cipher used for the encryption of data (based on the ChaCha20 and Poly1305 algorithms). There are no secure encryption algorithms optimized for mobile browsers and APIs in TLS right now—these new ciphers fill that gap.

There are two types of ciphers typically used to encrypt data with TLS: block ciphers and stream ciphers. In a block cipher, the data is broken up into chunks of a fixed size and each block is encrypted. In a stream cipher, the data is encrypted one byte at a time. Both types of ciphers have their advantages, block ciphers are generally fast in hardware and somewhat slow in software, while stream ciphers often have fast software implementations.

TLS has a secure block cipher, AES, that has been implemented in hardware and is generally very fast. One current problem with TLS is that there is no secure choice of stream cipher. The de facto stream cipher for TLS is RC4, which has been shown to have biases and is no longer considered secure.

AES is a fine cipher to use on most modern computers. Intel processors since Westmere in 2010 come with AES hardware support that makes AES operations effectively free. This makes it an ideal cipher choice for both our servers and for web visitors using modern desktop and laptop computers. It’s not ideal for older computers and mobile devices. Phones and tablets don’t typically have cryptographic hardware for AES and are therefore required to use software implementations of ciphers. The AES-GCM cipher can be particularly costly when implemented in software. This is less than optimal on devices where every processor cycle can cost you precious battery life. A low-cost stream cipher would be ideal for these mobile devices, but the only option (RC4) is no longer secure.

In order to provide a battery-friendly alternative to AES for mobile devices, several engineers from Google set out to find and implement a fast and secure stream cipher to add to TLS. Their choice — ChaCha20-Poly1305 — was included in Chrome 31 in November 2013, and Chrome for Android and iOS at the end of April 2014.

Having the option to choose a secure stream cipher in TLS is a good thing for mobile performance. Adding cipher diversity is also good insurance. If someone finds a flaw in one of the AES-based cipher suites sometime in the future, it gives a safe and fast option to fall back to.

Security

We previously spoke about the relative strength of different types of cryptography. Some keys are stronger than others, and when using new algorithms, the keys have to be chosen with the appropriate cryptographic strength. These new cipher suites are even more secure than the best standard choices.

The new cipher suites make use of two algorithms: ChaCha20, a stream cipher; and Poly1305, a code authenticator. Both of these cryptographic primitives were invented by Professor Dan Bernstein (djb) back in 2008 and 2005. They have been thoroughly vetted by academia and battle tested in Chrome for over a year.

From the IETF internet draft:

The ChaCha20 cipher is designed to provide 256-bit security.The Poly1305 authenticator is designed to ensure that forged messages are rejected with a probability of 1-(n/(2^102)) for a 16n-byte message, even after sending 2^64 legitimate messages, so it is SUF-CMA in the terminology of [AE](http://cseweb.ucsd.edu/~mihir/papers/oem.html).

In sum, the security level is more than sufficient for HTTPS. CloudFlare’s AES-GCM cipher provides around 128 bits of security, which is considered more than enough to future-proof communication. ChaCha20 goes far beyond that, providing 256 bits of security.

Poly1305 provides authentication, protecting TLS against attackers inserting fake messages into a secure stream. Poly1305’s key strength is considered strong enough to stop this attack, providing around 100 bits of security. Authentication in TLS is slightly less important than encryption because even if an attacker can add a fake message to the stream, they can’t read the information inside without breaking the encryption key.

ChaCha20-Poly1305 also uses the current recommended construction for combining encryption and authentication. It’s built using an Authenticated Encryption with Associated Data (AEAD) construction. AEAD is a way of combining a cipher and an authenticator together to get the combined properties of encryption and authentication. This would be done previously with two different algorithms, typically a block cipher and an HMAC. Authenticated encryption makes it impossible to decrypt a ciphertext out of order which helps rule out a whole class of problems including BEAST, Lucky 13 and POODLE. AEAD also makes the age-old discussion of MAC-then-encrypt vs encrypt-then-MAC obsolete by combining the two in the same operation. Our other preferred TLS 1.2 encryption algorithm, AES-GCM, is also an AEAD.

Performance

The new cipher suites are fast. As Adam Langley described, ChaCha20-Poly1305 is three times faster than AES-128-GCM on mobile devices. Spending less time on decryption means faster page rendering and better battery life. Although the cipher part of TLS may not be the biggest source of battery consumption (the handshake is more expensive (PDF)), spending fewer CPU cycles on encryption saves battery life, especially on large files.

For example: decrypting a 1MB file on the Galaxy Nexus (OMAP 4460 chip):

AES-128-GCM: 41.6msChaCha20-Poly1305: 13.2ms

The difference is more dramatic on less powerful Android phones and old iPhones running Chrome. There is also a comparable difference on pre-Sandy Bridge and low-powered Intel CPUs. With ChaCha/Poly, older computers and mobile devices spend less time and computational power on decryption.

On desktop computers with hardware AES support, AES-128-GCM is still the faster choice. CloudFlare is able to intelligently choose whether to choose AES or ChaCha/Poly for different clients based on the client’s advertised cipher preference. For recent Intel processors, we use the standard AES-GCM algorithm. For browsers on machines that do not have a hardware AES chip, we prefer the ChaCha20-Poly1305.

In order to support over a million HTTPS sites on our servers, we have to make sure CPU usage is low. To help improve performance we are using an open source assembly code version of ChaCha/Poly by CloudFlare engineer Vlad Krasnov and others that has been optimized for our servers’ Intel CPUs. This keeps the cost of encrypting data with this new cipher to a minimum.

Browser support and future directions

As of the most recent browser statistics, Chrome has over a third of the web browser market, making this change significant to a large number of users. Although ChaCha20-Poly1305 is a Chrome-only feature for now, it could gain even more widespread adoption soon. Mozilla is planning on adding support for ChaCha20-Poly1305 in Firefox, although this might take a while to complete. Apple also has a pending ticket tracking the implementation on iOS, although is unlikely to be completed since new 64-bit ARM processors (like the ones in iPhone 5s and later) have support for AES in hardware.

One thing to note is that the version of ChaCha/Poly implemented by both CloudFlare and Chrome is not the final version that will be standardized by the IETF. A more recent draft with slight modifications has been published and is on the road to standardization. We plan on adopting this new version of the cipher once it has been finalized.

Looking Ahead

ChaCha20-Poly1305 is a new cipher with a useful purpose: it improves performance for browsers in constrained environments. At the very least, it provides algorithm agility in case someone finds a serious flaw in AES-GCM, which is possible due to its fragility. In the future we plan to keep on adding the latest and best TLS features for our customers. You can track our configuration as it changes on Github.

If you want to enable ChaCha/Poly on your web server, we have included the patch for OpenSSL 1.0.2 here.

Do the ChaCha: better mobile performance with cryptography (4)

We protect entire corporate networks, help customers build Internet-scale applications efficiently, accelerate any website or Internet application, ward off DDoS attacks, keep hackers at bay, and can help you on your journey to Zero Trust.

Visit 1.1.1.1 from any device to get started with our free app that makes your Internet faster and safer.

To learn more about our mission to help build a better Internet, start here. If you're looking for a new career direction, check out our open positions.

TLS Speed & Reliability HTTPS SSL Security

Related Posts

Do the ChaCha: better mobile performance with cryptography (2024)

FAQs

Is ChaCha20 better than AES-256? ›

They're both better in terms of security than any of their counterparts that use shorter encryption keys. However, there's much more to encryption than key length. The main difference between AES-256 and XChaCha20 encryption is that AES-256 is a block cipher, whereas XChaCha20 is a stream cipher.

Is ChaCha20 faster than AES? ›

As a result, commercial AES hardware provides an edge over other kinds of cryptographic systems. But ChaCha20 is faster when running on standard hardware since it comprises three basic operations that are less complex than those used in AES.

What is ChaCha encryption? ›

Chacha20 is a cipher stream. Its input includes a 256-bit key, a 32-bit counter, a 96-bit nonce and plain text. Its initial state is a 4*4 matrix of 32-bit words. The first row is a constant string “expand 32-byte k” which is cut into 4*32-bit words. The second and the third are filled with 256-bit key.

How secure is ChaCha20-Poly1305? ›

Security. The ChaCha20-Poly1305 construction is proven secure in the standard model and the ideal permutation model, for the single- and multi-user setting. However, similarly to GCM, the security relies on choosing a unique nonce for every message encrypted.

Has AES 256 ever been cracked? ›

Has AES ever been cracked? The AES-256 block cipher hasn't been cracked yet, but there have been various attempts against AES keys. The first key-recovery attack on full AES was published in 2011 by Andrey Bogdanov, Dmitry Khovratovich, and Christian Rechberger.

Will AES 256 ever be cracked? ›

AES 256 is virtually impenetrable using brute-force methods. While a 56-bit DES key can be cracked in less than a day, AES would take billions of years to break using current computing technology. Hackers would be foolish to even attempt this type of attack. Nevertheless, no encryption system is entirely secure.

Which encryption is fastest? ›

Advanced Encryption Standard (AES) Algorithm

The Advanced Encryption Standard is the most common and extensively used symmetric encryption algorithm that is likely to be encountered nowadays (AES). It has been discovered to be at least six times quicker than triple DES.

What is the speed of ChaCha20 encryption? ›

Silex Insight announces record-breaking speed for their ChaCha20-Poly1305 solution - 800Gbps (ASIC) / 100Gbps (FPGA)

What is the difference between Salsa20 and ChaCha20? ›

ChaCha20 is a tweaked version of Salsa20 which improves both diffusion (every word is updated twice per per quarter-round instead of once as in Salsa20) and at the same time manages to use one fewer register.

Does ChaCha still work? ›

Yet after a decade of operations, ChaCha shut down. All that is left is a colossal failure and a few precious lessons.

Why did ChaCha shut down? ›

By the next month, ChaCha shut down operations due to declining advertising revenue, leaving them unable to service its debt.

How does ChaCha work? ›

ChaCha is a modification of Salsa20 published in 2008. It uses a new round function that increases diffusion and increases performance on some architectures. Both ciphers are built on a pseudorandom function based on add-rotate-XOR (ARX) operations — 32-bit addition, bitwise addition (XOR) and rotation operations.

How does ChaCha20 encryption work? ›

Similar to AES-CTR, ChaCha20 is a stream cipher. It generates a pseudo-random stream of bits from an incremented counter, the stream is then "XORed" with plaintext to encrypt it (or "XORed" with ciphertext to decrypt).

What level of security is ChaCha20? ›

The ChaCha20 cipher is designed to provide 256-bit security.

What is ChaCha20 used for? ›

The ChaCha20 stream cipher and the Poly1305 authenticator are cryptographic algorithms designed by Daniel J. Bernstein with the aim of ensuring high-security margins, while achieving high performance on a broad range of software platforms.

What encryption does the US government use? ›

The Advanced Encryption System (AES) is the current encryption standard for most government and private sector IT security purposes. AES was chosen as the U.S. government security standard in 2001, and eventually also evolved into the encryption standard for most private sector enterprises.

What encryption does the US military use? ›

Military-grade encryption refers to AES-256.

Military-grade encryption refers to a specific encryption type – AES (Advanced Encryption Standard, or Rijndael) algorithm. This encryption method was established in 2001 by the U.S. National Institute of Standards and Technology (NIST).

Does the military use AES-256? ›

U.S. government entities such as the NSA, the military, and many other entities use AES encryption for secure communication and storage of data. Many devices, applications, and networks today use AES-256 encryption to protect data at rest and in transit.

What is the most unbreakable encryption? ›

There is only one known unbreakable cryptographic system, the one-time pad, which is not generally possible to use because of the difficulties involved in exchanging one-time pads without their being compromised. So any encryption algorithm can be compared to the perfect algorithm, the one-time pad.

What is the most secure cryptographic algorithm? ›

The Advanced Encryption Standard (AES) is the algorithm trusted as the standard by the U.S. Government and numerous organizations. Although it is highly efficient in 128-bit form, AES also uses keys of 192 and 256 bits for heavy-duty encryption purposes.

Can quantum computers break AES? ›

Symmetric encryption, or more specifically AES-256, is believed to be quantum-resistant. That means that quantum computers are not expected to be able to reduce the attack time enough to be effective if the key sizes are large enough.

Can hackers bypass encryption? ›

Encryption converts data into ciphertext, which usually prevents hacker access to it in the first place. Though they can try to bypass it, a high level of encryption, such as AES 256-bit, will provide a strong layer of protection that can take several years to crack.

What is the best encryption to use? ›

Advanced Encryption Standards (AES)

The Advanced Encryption Standard (AES) is the algorithm trusted as the standard by the U.S. government and many other organizations. Although it is extremely efficient in 128-bit form, AES encryption also uses keys of 192 and 256 bits for heavy-duty encryption.

What is cryptography vs encryption? ›

Encryption vs cryptography: Cryptography is the science of concealing messages with a secret code. Encryption is the way to encrypt and decrypt data. The first is about studying methods to keep a message secret between two parties (like symmetric and asymmetric keys), and the second is about the process itself.

Does encryption affect speed? ›

And on modern hardware, encryption and decryption using the AES standard takes place in the CPU, which means that any impact on data transfer speeds is negligible.

How long does it take to break 256-bit encryption? ›

With the right quantum computer, AES-128 would take about 2.61*10^12 years to crack, while AES-256 would take 2.29*10^32 years.

How long does it take to encrypt 1 GB? ›

So how long will encryption take?
500 GB drive17 hours
1 TB drive33 hours
2 Tb drive67 hours

Is Salsa20 secure? ›

Salsa20 is a 256-bit stream cipher that has been proposed to eSTREAM, ECRYPT Stream Cipher Project, and is considered to be one of the most secure and relatively fastest proposals.

What is ChaCha20 Poly1305 Openssh com? ›

The "chacha20-poly1305@openssh.com" combines these two primitives into an authenticated encryption mode. The construction used is based on that proposed for TLS by Adam Langley in [I-D.agl-tls-chacha20poly1305], but differs in the layout of data passed to the MAC and in the addition of encyption of the packet lengths.

Is ChaCha20 asymmetric? ›

ChaCha20 is considered very secure and is widely studied and deployed. Use of Poly1305 is recommended. This algorithm is considered very secure. Usually used with an symmetric encryption algorithm, while RSA "only" encrypts the symmetric key .

When did ChaCha shut down? ›

On December 12, 2016, ChaCha shut down operations due to declining advertising revenue, which left it unable to service its debt.

How do you text ChaCha for answers? ›

Basically, you can text any question to "242242" (which spells "chacha" on a phone) and a "live search expert" will respond. I tried it out with some questions that I thought might be useful if I were out on the road and not sitting at my computer and the answers were accurate and, in general, very prompt.

How many counts are in ChaCha? ›

The original Cuban and the ballroom cha-cha-cha count is "one, two, three, cha-cha", or "one, two, three, four-and." A "street version" comes about because many social dancers count "one, two, cha-cha-cha" and thus shift the timing of the dance by a full beat of music.

What is ChaCha net worth? ›

Net Worth. Chacha Eke has a net worth of $700,000 and is one of Nigeria's most influential actresses.

When did ChaCha become popular? ›

First introduced to the United States in 1954, the popular dance was at one time referred to as Cha Cha Cha. By 1959, the dance movement gained so much popularity that it eventually replaced the Mambo as the most popular dance.

What does ChaCha mean in slang? ›

If you WERE Indian, however, you would know that Chacha means Uncle. Actually, it means a lot more than Uncle. When I call someone Chacha, anyone who heard me would know not only that that person was my Uncle, but that my relation to him was on my father's side, and that he was younger than my father.

Why is Chacha popular? ›

The cha-cha endures as a popular ballroom dance partly because of its appealing mix of breezy movements and smoldering sensuality. Some things to keep in mind as you perform the cha-cha: Cha-cha music is in 4/4 time. Steps are small and compact, with most of the movement happening in the hips and pelvic areas.

What is the importance of the chacha? ›

The Benefits of Cha-Cha

Show Off Your Self-Expression: like any dance, the cha-cha places emphasis on dancers' self-expression. In other words, the more you cha-cha, the more you'll feel comfortable expressing yourself through movement!

What do you know about Chacha? ›

The Cha Cha is a playful and flirtatious dance known for it's vibrant energy. Although it is traditionally danced to up-beat music with a Latin or Cuban beat, today it is common to dance the Cha Cha to many current styles of music including Top 40, Pop and R&B.

Can hackers decrypt encrypted data? ›

Hackers can break encryption to access the data using a number of different methods. The most common method is stealing the encryption key itself. Another common way is intercepting the data either before it has been encrypted by the sender or after it has been decrypted by the recipient.

How do hackers crack encryption? ›

One of the most common ways for hackers to obtain sensitive data is to steal the encryption key or intercept the data before it is actually encrypted or after it has been decrypted. However, when this is not possible, the hackers are able to add an encryption layer which is performed by using an attacker's key.

What are the four 3 most secured encryption techniques? ›

Best Encryption Algorithms
  • AES. The Advanced Encryption Standard (AES) is the trusted standard algorithm used by the United States government, as well as other organizations. ...
  • Triple DES. ...
  • RSA. ...
  • Blowfish. ...
  • Twofish. ...
  • Rivest-Shamir-Adleman (RSA).
Nov 11, 2022

What is cryptanalysis of ChaCha20? ›

The cryptanalysis of ChaCha involves a differential attack which exploits the idea of Probabilistic Neutral Bits (PNBs). For a long period, the single-bit distinguisher in this differential attack was found up to 3 rounds.

How many levels are in security? ›

How many types or levels of security clearance are there? There are three levels of security clearance: confidential, secret, and top secret.

What is stream cipher in cryptography? ›

A stream cipher is an encryption technique that works byte by byte to transform plain text into code that's unreadable to anyone without the proper key. Stream ciphers are linear, so the same key both encrypts and decrypts messages.

Is ChaCha20 more secure than AES? ›

They're both better in terms of security than any of their counterparts that use shorter encryption keys. However, there's much more to encryption than key length. The main difference between AES-256 and XChaCha20 encryption is that AES-256 is a block cipher, whereas XChaCha20 is a stream cipher.

Is ChaCha20 better than AES? ›

As a result, commercial AES hardware provides an edge over other kinds of cryptographic systems. But ChaCha20 is faster when running on standard hardware since it comprises three basic operations that are less complex than those used in AES.

What is ChaCha in cryptography? ›

ChaCha is a family of stream ciphers by Daniel J. Bernstein based on a variant of Salsa20. Also see ChaCha, a variant of Salsa20. The 20-round stream cipher ChaCha/20 is consistently faster than AES and is recommended by the designer for typical cryptographic applications.

Is there anything better than AES 256? ›

AES-128 is faster and more efficient and less likely to have a full attack developed against it (due to a stronger key schedule). AES-256 is more resistant to brute force attacks and is only weak against related key attacks (which should never happen anyway).

Is AES 256 the best encryption? ›

2.Is AES the best encryption method? Because of its key length options, AES encryption remains the best choice for securing communications. The time required to crack an encryption algorithm is directly related to the length of the key used, i.e., 128-bit, 192-bit, and 256-bit.

Is AES 256 the strongest? ›

The algorithm provides 128-bit block encryption and has been designed to supports key sizes of 128, 192 and 256 bits. AES 256-bit encryption is the strongest and most robust encryption standard that is commercially available today.

Is AES 256 the best? ›

Out of 128-bit, 192-bit, and 256-bit AES encryption, 256-bit AES encryption is technically the most secure because of its key length size. Some go as far as to label 256-bit AES encryption overkill because it, based on some estimations, would take trillions of years to crack using a brute-force attack.

Top Articles
THE PRETTIEST | Kirkus Reviews
Is Now a Good Time to Buy in Crypto? Expert Analysis [03/2024]
Red wine, berries, dark chocolate and tea: A recipe to reduce dementia risk
Amwednesday Vimeo
Find used motorbikes for sale on Auto Trader UK
Moana Nail Salon Katy Tx
Craigslist Rooms For Rent Oxnard
Kia North Huntingdon Pa
Jiffy Lube D'iberville Reviews
Pawn Shops In Sylva Nc
Northwest Ga Trader Pets
Norris Funeral Home Chatham Va Obituaries
Keith Niebuhr Twitter
los angeles cars & trucks - by owner "used cars" - craigslist
Bone Of The Ancients
Bj타리
Tulsa police probe Craigslist posting bragging of "first kill"
Panter Belico Net Worth
Steve Hytner Net Worth
Tar Heels Baseball Schedule
Carle Sdn 2023
Kerangbulu Com
UNITE 7SECONDS Condition Leave in Detangler 60ml GWP 60 ml
Udk Raid
Jessica Oldwyn Carroll Update
Theater + Tickets - Phoenix Theatres Savoy 16 + IMAX - Phoenix Theatres Entertainment
Federal Express Drop Off Center Near Me
Crytek director says Hunt: Showdown's big August update represents 'a significant relaunch of Hunt: Showdown at a whole new level'
Pay Dates For Nc State Retirees
Mexican Salad with Creamy Avocado Dressing: A Fresh and Flavorful Side Dish
Ric Flair's Net Worth (Updated 2023) | Inspirationfeed
Racing Games Unblocked 66
Small Party Hall Near Me
Vfr Town Of Salem
Espn Forecaster
Dora Saves Fairytale Land/Transcript
Series of scorching days: Last week the hottest worldwide on record: UN
Overtime Megan File Download
Oil Change Services | Jiffy Lube
Find Such That The Following Matrix Is Singular.
Craigslist Centre Alabama
Csulb Atlas
new hampshire houses for rent - craigslist
Craigslist Farm And Garden - By Owner Nebraska
Nyu Paralegal Program
Koikatsu Card Booru
Armslist Dayton
Coors Field Seats In The Shade
Litquidity Compensation Survey
Quantum Break: Die Steamversion mit DirectX 11 im Technik-Test mit 15 Grafikkarten
2024 Indian Calendar for Indian Festivals and Indian Holidays
Latest Posts
Article information

Author: Annamae Dooley

Last Updated:

Views: 6806

Rating: 4.4 / 5 (45 voted)

Reviews: 92% of readers found this page helpful

Author information

Name: Annamae Dooley

Birthday: 2001-07-26

Address: 9687 Tambra Meadow, Bradleyhaven, TN 53219

Phone: +9316045904039

Job: Future Coordinator

Hobby: Archery, Couponing, Poi, Kite flying, Knitting, Rappelling, Baseball

Introduction: My name is Annamae Dooley, I am a witty, quaint, lovely, clever, rich, sparkling, powerful person who loves writing and wants to share my knowledge and understanding with you.