RFC 8439 — authenticated encryption with a 192-bit nonce.
XChaCha20-Poly1305 is the authenticated symmetric cipher UltimaOS uses for every payload. Specified in RFC 8439, it combines the XChaCha20 stream cipher (a 192-bit nonce extension of ChaCha20) with the Poly1305 universal hash for authentication.
Authenticated symmetric encryption runs at gigabytes per second on a modern CPU, orders of magnitude faster than public-key operations. Using symmetric primitives for actual data is the only practical choice at scale.
Grover's algorithm gives quantum computers a square-root speedup against symmetric ciphers. A 256-bit key retains 128-bit effective security against a quantum attacker — far beyond any plausible brute-force capability.
ChaCha20 is a stream cipher designed by Daniel J. Bernstein in 2008, selected for its simplicity, performance, and resistance to side-channel attacks. It is widely used: TLS 1.3, WireGuard, OpenSSH.
Enveloped payloads on UltimaOS — chat messages, mail, files, notes, tasks, documents and spreadsheets — are encrypted with XChaCha20-Poly1305 using a 256-bit symmetric key derived from the ML-KEM-768 session. Calendar events and AI conversation history are outside that envelope today.
Each conversation, file share, or call uses a fresh 256-bit symmetric key, derived from the ML-KEM-768 encapsulation. There is no long-term symmetric key on the server.
XChaCha20's 192-bit nonce (24 bytes) is large enough that random nonces can be used safely — collision probability remains negligible even after 2^64 messages with the same key.
Poly1305 computes a 16-byte authenticator over the ciphertext and any associated data. Tampering with the ciphertext or headers invalidates the tag, and the receiving client refuses to decrypt.
Files are split into chunks, each with its own nonce and Poly1305 tag. Chunks can be verified and decrypted in any order, enabling streaming download without waiting for the full file.
Modern CPUs from Intel, AMD, and ARM all include AES-NI or equivalent vector instructions. ChaCha20 is the chosen cipher for systems without hardware AES (mobile devices) or for side-channel resistance.
Nonce generation uses a per-message counter combined with the random nonce prefix. With 192-bit nonces, reuse is statistically impossible even after billions of messages per session.
Reference implementations of ChaCha20 are constant-time, eliminating side-channel leakage of key material through timing or cache analysis.
The cryptographic primitives come from @noble — audited, widely-used, pure-TypeScript implementations reviewed by the cryptographic community — running in the client you can inspect. Anyone is free to audit our use of them.
Short answer
XChaCha20-Poly1305 is an authenticated encryption with associated data (AEAD) cipher. It combines the XChaCha20 stream cipher (24-byte nonce variant of ChaCha20) with the Poly1305 MAC for authentication. It is specified in RFC 8439. (RFC 8439)
Short answer
Both are excellent ciphers. XChaCha20 has the practical advantage of constant-time software implementations without requiring hardware AES instructions, making it more robust against side-channel attacks on mobile devices. The 192-bit nonce also makes random-nonce constructions safe.
Short answer
Grover's algorithm provides a quadratic speedup against symmetric ciphers. A 256-bit key retains 128-bit effective quantum security, which is far beyond any plausible brute-force capability — including by quantum computers.
Short answer
XChaCha20 uses a 192-bit nonce (24 bytes) instead of ChaCha20's 96-bit nonce (12 bytes). The extra nonce bits are derived by running ChaCha20 with a derived key. The longer nonce allows safe random nonce generation without exhaustion concerns.
Short answer
Poly1305 is a fast universal hash function designed by Daniel J. Bernstein. In AEAD constructions like XChaCha20-Poly1305, Poly1305 computes a 16-byte authenticator over the ciphertext that proves the ciphertext was not tampered with.
Short answer
Yes. TLS 1.3 (RFC 8446) supports ChaCha20-Poly1305 as a cipher suite. WireGuard VPN uses ChaCha20-Poly1305 exclusively. OpenSSH has used ChaCha20-Poly1305 since version 6.5.
Short answer
Poly1305 is a universal hash; its output is unforgeable under standard cryptographic assumptions. Even if a collision occurred (probability ~2^-128), it would not allow forgery without breaking Poly1305 itself, which would imply breaking AES.
No ads, no data mining, no trial clock. Individual and family accounts are free — permanently. Organisations pay per seat, and that is what funds it.