#nacl #libsodium #public-key #chacha20 #poly1305

no-std crypto_secretstream

Pure Rust implementation of libsodium's crypto_secretstream secret-key using ChaCha20 and Poly1305

4 releases (2 breaking)

0.2.0 Jul 22, 2023
0.1.1 Dec 1, 2022
0.1.0 Aug 14, 2022
0.0.1 Aug 30, 2021

#5 in #chacha20-poly1305

Download history 9/week @ 2023-08-06 17/week @ 2023-08-13 15/week @ 2023-08-20 21/week @ 2023-08-27 39/week @ 2023-09-03 24/week @ 2023-09-10 8/week @ 2023-09-17 10/week @ 2023-09-24 23/week @ 2023-10-01 63/week @ 2023-10-08 27/week @ 2023-10-15 72/week @ 2023-10-22 29/week @ 2023-10-29 18/week @ 2023-11-05 54/week @ 2023-11-12 27/week @ 2023-11-19

141 downloads per month
Used in 2 crates (via hypercore-protocol)

Apache-2.0 OR MIT

403 lines

RustCrypto: crypto_secretstream

crate Docs Apache2/MIT licensed Rust Version Project Chat Build Status

Pure Rust implementation of libsodium's crypto_secretstream primitive, providing an AEAD using ChaCha20 and Poly1305.

It is tested against sodiumoxide, a Rust libsodium bindings.



Imagine Alice wants to open a safe channel of communication with Bob, one that can't be read or modified by anyone else.

One way she can do this is by first agreeing with Bob on a shared secret key (such as one generated via a key exchange protocol), then she opens a normal/unsafe channel of communication and sends her messages, encrypted under this shared key. Then, when Bob receives these messages, he can decrypt each one and the mere knowledge of this shared key ensures that it was indeed sent by Alice.

Under the hood, the first message is postfixed with a random number, called a nonce, generated by Alice, which is taken into account during encryption and decryption. It is then incremented for each new message.

It also allows for additional data to be sent with each message. This data is not encrypted but used in the encryption process thus it is needed to be known in advance by the receiver. It can be useful for adding another layer of security, and is not of a fixed size as the key is.


Licensed under either of:

at your option.


Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.


  • auto-rekeying on counter overflow is not tested
  • Tag::Final doesn't actually do anything, as libsodium does but not sodiumoxide
  • Key and Nonce aren't zeroize, maybe it should
  • MAC check in PullStream is not constant time


~20K SLoC