Struct XChaCha20Poly1305 

pub struct XChaCha20Poly1305 { /* private fields */ }

XChaCha20-Poly1305: ChaCha20-Poly1305 with a 192-bit nonce (draft-irtf-cfrg-xchacha-03).

The first 16 bytes of the nonce and the key give a subkey through HChaCha20; the last 8, after four zero bytes, are the nonce ChaCha20-Poly1305 runs with under that subkey.

The point is the nonce’s length. A 96-bit nonce drawn at random collides often enough that a long-lived key cannot use one; a 192-bit one does not, so seal_with_random_nonce draws each nonce and needs no counter kept anywhere. That is what to use. Passing a nonce by hand through Aead is for a protocol that dictates one, and carries the same rule as every AEAD: never twice under one key.

The specification is an Internet-Draft that expired in 2020 without becoming an RFC. The construction is what libsodium, Go and Tink implement, and it is checked here against the draft’s vectors and Project Wycheproof’s.

Implementations

impl XChaCha20Poly1305

pub fn seal_with_random_nonce<R: RandomSource + ?Sized>( &self, rng: &mut R, aad: &[u8], in_out: &mut [u8], tag: &mut [u8], ) -> Result<[u8; 24]>

Seal under a nonce drawn from rng, and return the nonce.

The nonce is not secret; send it with the ciphertext. Pass ic_drbg::Rng, not raw OS bytes.

Trait Implementations

impl Aead for XChaCha20Poly1305

const KEY_LEN: usize = 32

Key length in bytes.

const NONCE_LEN: usize = 24

Nonce length in bytes.

const TAG_LEN: usize = 16

Authentication tag length in bytes.

fn new(key: &[u8]) -> Result<Self>

Bind a key to a cipher instance.

fn seal_detached( &self, nonce: &[u8], aad: &[u8], in_out: &mut [u8], tag: &mut [u8], ) -> Result<()>

Encrypt in_out in place and write the tag to tag.

fn open_detached( &self, nonce: &[u8], aad: &[u8], in_out: &mut [u8], tag: &[u8], ) -> Result<()>

Verify tag and decrypt in_out in place.

impl Algorithm for XChaCha20Poly1305

const ID: &'static str = "xchacha20-poly1305"

Stable ontology identifier for this algorithm.

const NAME: &'static str = "XChaCha20-Poly1305"

Human-facing display name (for example "SHA-256").

impl Drop for XChaCha20Poly1305

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl SelfTest for XChaCha20Poly1305

fn self_test() -> Result<()>

The AEAD vector of draft-irtf-cfrg-xchacha-03 appendix A.3.1, sealed and opened.