AEAD Encryption (ChaCha20-Poly1305)

WireGuard uses ChaCha20-Poly1305 for transport encryption.

ChaCha20: stream cipher by Daniel Bernstein. Fast in software (no AES-NI needed). Strong provable security.

Poly1305: MAC (message authentication code). Pairs with ChaCha20 for AEAD.

Per packet:

Counter starts at 0 per direction, increments per packet. Wrap-around triggers rekey (long before practical wraparound).

AAD (Authenticated Additional Data): in WireGuard, empty for transport packets. Some VPNs put outer header in AAD to authenticate it.

Tag size: 16 bytes appended to ciphertext.

Why ChaCha20 over AES-GCM?

• Software performance: 3-4x faster on devices without AES-NI (mobile, embedded).
• Constant-time by construction.
• Simpler to implement.
• AES-GCM has nonce-misuse cliff; ChaCha20 is similar but constants of design differ.

WireGuard's choice has aged well. Mobile/IoT/cloud all benefit.

Decryption failure handling:

• Any bad packet → silently drop.
• Don't return ICMP unreachable (privacy).
• Don't allocate state for unauthenticated input (DOS defense).

Cookie reply (rate-limit DOS):

• Server overwhelmed → answers initiation with cookie.
• Client must echo cookie to be processed.
• Cookie = HMAC(server_secret, client_addr) — proves client is at claimed IP.