Boring crypto that simply works


This section is about incremental interfaces (for authenticated encryption and signatures), as well as low level primitives (Chacha20, HChacha20, Poly1305, and X25519). Most users should not need them.

Using these comes with more caveats than the basic interface: incremental interfaces let the user process data before it has been authenticated (this has opened many vulnerabilities), and low level primitives are easy to mix up in the wrong way.

Please be careful.