Archivecryptography
ChaCha20-Poly1305 vs AES-GCM
Both are safe AEADs. The choice is about hardware, side channels, and nonce size — not raw strength.
- Published
- Reading time
- 1 min read
AES-GCM is fast where AES instructions exist: x86 with AES-NI and most ARM cores. Without them, software AES is slow and timing-sensitive. ChaCha20-Poly1305 is constant-time in pure software and competitive on mobile and embedded targets.
The real differences
| AES-GCM | ChaCha20-Poly1305 | |
|---|---|---|
| Hardware | AES-NI / ARMv8 crypto | none needed |
| Nonce | 96-bit standard | 96-bit standard, 192-bit XChaCha |
| Timing | table-based impls leak | naturally constant-time |
| Misuse resistance | nonce reuse fatal | nonce reuse fatal |
Neither is broken. TLS 1.3 negotiates both, and clients typically prefer AES on hardware with acceleration and ChaCha otherwise.
What to actually decide
- Deploying to unknown or low-power clients: ChaCha20-Poly1305.
- Server-side bulk encryption with AES-NI: AES-GCM is fine and often faster.
- Need random nonces without coordination: XChaCha20-Poly1305.
Takeaway: pick based on platform and nonce strategy. "AES is stronger" is not a reason — both provide 128-bit security when used correctly.