ChaCha20 Stream

Category: Symmetric Ciphers · Node Type ID: symmetric-chacha20-stream

Pure ChaCha20 Stream Cipher without Poly1305 MAC (RFC 8439)

Overview

Executes the pure IETF ChaCha20 stream cipher (RFC 8439 §2.4) without the Poly1305 MAC, XORing the input data with the ChaCha20 keystream generated from a 32-byte key and a 12-byte nonce.

Because stream cipher encryption and decryption are identical XOR operations against the same keystream ($C = P \oplus KS$, $P = C \oplus KS$), this single node performs both encryption and decryption. Note that pure ChaCha20 provides confidentiality only and does not detect ciphertext tampering unless paired with an external MAC.

When to Use

Encrypting or decrypting raw ChaCha20 streams, generating raw keystreams (by feeding all-zero bytes into Input Data), or reproducing RFC 8439 §2.4.2 test vectors.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Unify Errors `errorUnify`	`boolean` Default: `false` Supports Variable Reference (`$var`: `bool`)	Always visible	Replaces built-in errors with a custom error code/message when enabled.
Unified Error Code `errorUnifyCode`	`text` Default: `""` (empty) Supports Variable Reference (`$var`: `string`)	When `errorUnify` is `true`	Custom error code when Unify Errors is enabled.
Unified Error Message `errorUnifyMessage`	`text` Default: `""` (empty) Supports Variable Reference (`$var`: `string`)	When `errorUnify` is `true`	Custom error message when Unify Errors is enabled.

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (3 total).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Key`	`key`	`Bytes` (32B)	Required	Always visible	32-byte (256-bit) ChaCha20 secret key.
`Data In`	`data`	`Bytes`	Required	Always visible	Plaintext or ciphertext byte array (`Uint8Array`) to XOR with the ChaCha20 keystream.
`Nonce`	`nonce`	`Bytes` (12B)	Optional	Always visible	12-byte (96-bit) IETF nonce (defaults to 12 zero bytes if unconnected).

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Data Out`	`data`	`Bytes`	Always visible	Plaintext or ciphertext byte array (`Uint8Array`) to XOR with the ChaCha20 keystream.

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute. Enabling Unify Errors (errorUnify) replaces all error codes below with your configured unified error code and message.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_LENGTH`	Invalid key length	Raised when `Key` is not 32 bytes.
`INVALID_NONCE_LENGTH`	Invalid nonce length	Raised when a connected `Nonce` is not 12 bytes.

Examples

Symmetric Stream Encryption and Decryption with Pure ChaCha20

Pass plaintext through one ChaCha20 Stream Cipher node to encrypt, and pass the output through a second identical node to recover the plaintext.

Connect a 32-byte Key, 12-byte Nonce, and plaintext to the first ChaCha20 Stream Cipher.
Feed its Output Stream into a second ChaCha20 Stream Cipher wired to the same Key and Nonce to recover the original plaintext.