v151 · security · aead

ChaCha20-Poly1305 AEAD

ChaCha20-Poly1305 (RFC 8439) is an authenticated cipher: a single operation both encrypts your data and produces a Poly1305 tag that detects any tampering. This demo runs the real crypto.subtle.encrypt / decrypt with the new ChaCha20-Poly1305 algorithm, including an additional authenticated data field, and lets you corrupt the ciphertext, nonce, or AAD to watch authentication fail.

Experimental — behind a flag. The modern WebCrypto algorithms are gated on the WebCryptoPQC runtime feature. To run this for real:

Quit Chrome, then relaunch with --enable-blink-features=WebCryptoPQC (in a Chrome/Canary build containing the experimental implementation), or
Join the WebCryptoAdditionalAlgorithms202606 origin trial and add its token to your page.

Until then the buttons attempt the real call and report exactly what the browser returns — no simulated success.

plaintext additional authenticated data (not encrypted, but authenticated)

checking support…

nonce (12 bytes) · ciphertext + 16-byte Poly1305 tag

—

recovered plaintext

—

the code

const key = await crypto.subtle.generateKey(
  { name: "ChaCha20-Poly1305" }, true, ["encrypt", "decrypt"]);

const nonce = crypto.getRandomValues(new Uint8Array(12)); // 96-bit nonce
const params = { name: "ChaCha20-Poly1305", iv: nonce, additionalData: aad };

const ciphertext = await crypto.subtle.encrypt(params, key, plaintext);
// ciphertext ends with a 16-byte Poly1305 authentication tag

const recovered = await crypto.subtle.decrypt(params, key, ciphertext);
// throws OperationError if the ciphertext, nonce, OR aad was altered

Because it is authenticated encryption, decryption is all-or-nothing: change a single byte of the ciphertext, reuse the wrong nonce, or feed different associated data, and decrypt() rejects with an OperationError instead of returning corrupted plaintext. Never reuse a nonce with the same key.

ChaCha20-Poly1305 AEAD

the code

see also

references