Skip to main content

An AEAD construction per RFC7539

Project description

PyPI Travis


RFC7539 is an IETF specification for an authenticated encryption algorithm that will be incorporated into TLSv1.3. It is comprised of a stream cipher (ChaCha20) and a MAC (Poly1305), both written by Daniel J. Bernstein. The C implementations for both of these primitives are taken from the NSS library (the reason being that openSSL has license incompatibilities and also requires the openSSL headers which is more overhead than we need to implement these fairly basic primitives). The NSS code has been slightly modified to account for the 96 bit nonce and 32 bit counter specified in the RFC.


Method 1

pip install rfc7539

Method 2

git clone
cd rfc7539
python install


You should use the authenticated encryption mode unless you really need to use one of the primitives by itself:

from rfc7539 import aead
from os import urandom

key = urandom(32)  # key is 32 bytes
nonce = 'thisisanonce'  # nonce is 12 bytes (DO NOT REUSE A NONCE WITH THE SAME KEY)
message = 'Some message to be encrypted'
additional_data = 'Some additional data'  # this will not be encrypted but will be verified for integrity

# encryption
ciphertext, mac = aead.encrypt_and_tag(key, nonce, message, additional_data)

# decryption (which yields plaintext == message)
plaintext = aead.verify_and_decrypt(key, nonce, ciphertext, mac, additional_data)

Notes on Python 2 vs 3

In python2 encryption and decryption and tagging will return str data while in python3 they will return bytes data. This is consistent with how much of the python library operates between the two versions (e.g. see binascii.unhexlify). This can lead to some strange behavior if e.g. you encrypt a str value in python3 and, after decrypting, your decrypted value does not match your original value because you got bytes back from the decryption. If the returned type is undesirable it is of course always possible to convert between bytes and str as needed.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
rfc7539-1.2.1-cp27-cp27m-macosx_10_13_x86_64.whl (14.2 kB) Copy SHA256 hash SHA256 Wheel cp27
rfc7539-1.2.1-cp37-cp37m-macosx_10_13_x86_64.whl (14.3 kB) Copy SHA256 hash SHA256 Wheel cp37
rfc7539-1.2.1.tar.gz (24.7 kB) Copy SHA256 hash SHA256 Source None

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page