Lion Cipher Lab
Build ChaCha20-Poly1305 from Scratch (and Forge an Unauthenticated Stream Cipher)
- Foundations
- Intermediate
- ~90 min
- Free · no account required
Why it matters
ChaCha20-Poly1305 is one of the two authenticated ciphers that actually carries the modern internet: it is a mandatory-to-implement cipher suite in TLS 1.3, it secures WireGuard and SSH and QUIC, and it is the fast, constant-time, no-special-hardware alternative to AES-GCM on phones and embedded chips. But the reason it matters for a learner is the lesson underneath it. Encryption hides a message; it does NOT stop an attacker from changing it. A stream cipher like ChaCha20 produces a keystream that you XOR with your data -- which means an attacker who never learns your key can still flip any…
What you'll learn
- Implementing the ChaCha20 stream cipher by hand from RFC 8439 -- the quarter-round, the 16-word state, and the block function
- Implementing the Poly1305 one-time MAC with the 2^130 - 5 prime field and the r-clamp, and understanding why it is ONE-time
- Assembling the ChaCha20-Poly1305 AEAD exactly as RFC 8439 Section 2.8 specifies (one-time key gen, encrypt, then MAC over AAD + ciphertext + lengths)
- Proving a stream cipher is malleable: flipping chosen ciphertext bytes rewrites the plaintext in an attacker-chosen way, with no key
- Seeing authentication stop that exact attack dead -- tamper, and tag verification rejects it before you ever see a plaintext
- The failure modes that bite in production: nonce reuse, one-time MAC reuse, non-constant-time tag compare, and when to reach for a real library instead
Steps in this lab
- What an AEAD is, in one breath
- Why XOR keystream is malleable (the idea before the code)
- Set up and build the ChaCha20 quarter-round and block function
- Encrypt with ChaCha20 and validate the Section 2.4.2 vector
- Build the Poly1305 one-time MAC and validate Section 2.5.2
- Assemble the AEAD exactly as RFC 8439 Section 2.8 specifies
- BEFORE: forge a message against ChaCha20 ALONE
- AFTER: the AEAD rejects the exact same tampering
- Honest negatives: the sharp edges that cause real CVEs
- The judgment call: 'encrypted' is not 'safe'