Blog | G5 Cyber Security

Linux ChaCha20-Poly1305 Encryption: Reliable Options

G5 Cyber Security

TL;DR

Yes, several reliable Linux implementations of ChaCha20-Poly1305 exist for stream encryption. OpenSSL and libsodium are the most commonly used and recommended options due to their widespread availability, security audits, and ease of integration. This guide covers how to use them.

Using OpenSSL

  1. Check OpenSSL Version: Ensure you have a recent version (1.1.1 or later) for ChaCha20-Poly1305 support. 
    openssl version
  2. Encryption Example: Use the openssl enc command to encrypt and decrypt files. 
    openssl enc -aes-256-chacha20 -salt -in plaintext.txt -out ciphertext.enc -k "your_secret_key"

    Replace plaintext.txt with your input file, ciphertext.enc with the desired output filename and "your_secret_key" with a strong password.

  3. Decryption Example: Decrypt the ciphertext. 
    openssl enc -aes-256-chacha20 -d -salt -in ciphertext.enc -out decrypted.txt -k "your_secret_key"

    Use the same key you used for encryption.

  4. Important Note: OpenSSL uses AES-256-chacha20 as its ChaCha20 implementation, which is a hybrid approach. For pure ChaCha20-Poly1305, consider libsodium (see below).

Using Libsodium

  1. Install Libsodium: Use your distribution’s package manager.
    • Debian/Ubuntu: 
      sudo apt-get update && sudo apt-get install libsodium-dev
    • Fedora/CentOS/RHEL: 
      sudo dnf install libsodium-devel
  2. C Example: Here’s a basic example of encrypting and decrypting with Libsodium. 
    #include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sodium.h&gt>

int main() {
  if (sodium_init() == -1) {
    return 1;
  }

  unsigned char key[crypto_secretbox_KEYBYTES];
  randombytes_buf(key, sizeof(key));

  unsigned char nonce[crypto_secretbox_NONCEBYTES];
  randombytes_buf(nonce, sizeof(nonce));

  unsigned char message[1024];
  strcpy((char *)message, "This is a secret message.");

  unsigned char ciphertext[1024];
  crypto_secretbox_easy(ciphertext, message, strlen((char *)message), nonce, key);

  printf("Ciphertext: ");
  for (int i = 0; i < crypto_secretbox_MACBYTES + strlen((char *)message); ++i) {
    printf("%02x", ciphertext[i]);
  }
  printf("n");

  unsigned char decrypted[1024];
  if (crypto_secretbox_open_easy(decrypted, ciphertext, crypto_secretbox_MACBYTES + strlen((char *)message), nonce, key) != 0) {
    fprintf(stderr, "Decryption failed.n");
    return 1;
  }

  printf("Decrypted: %sn", decrypted);

  return 0;
}
  3. Compile and Run: Compile the C code using: 
    gcc -o chacha20_example chacha20_example.c -lsodium

    Then run it with ./chacha20_example.

Security Considerations

Exit mobile version