Golang x/crypto/chacha20: chacha20 is extremely slow even slower than chacha20-poly1305

Go version

go 1.25.0 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/home/codespace/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/codespace/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build145568968=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/workspaces/go-encrypt-test/go.mod'
GOMODCACHE='/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/codespace/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.5'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

benchmark chacha20

What did you see happen?

BenchmarkAES256GCM-2              301892              4369 ns/op        1875.05 MB/s
BenchmarkAES256CTR-2              794265              1505 ns/op        5443.42 MB/s
BenchmarkChaCha20Poly1305-2       230552              5786 ns/op        1415.79 MB/s
BenchmarkChaCha20-2                84082             14384 ns/op         569.52 MB/s        ←here, slower than AEAD

What did you expect to see?

A stream cipher should be at least faster than AEAD with it It's ok on AES256CTR/AES256GCM but chacha20 is slower than chacha20-poly1305, that's very strange I write a benchmark https://github.com/Fangliding/go-encrypt-test/blob/main/main_test.go and here is the result https://github.com/Fangliding/go-encrypt-test/actions/runs/17172546494/job/48724094779

chacha20 is very slow, it seems that some optimization is missing

Comment From: gabyhelp

Related Issues

• x/crypto/chacha20poly1305: linux/arm64 Go 1.9 performance is 3X slower than OpenSSL #22809 (closed)
• x/crypto/chacha20poly1305: 15% performance regression on certain cpus #67240
• crypto/tls: drop in BenchmarkThroughput performance #17779 (closed)
• x/crypto/chacha20: not compatible with OpenSSL #55095 (closed)
• proposal: x/crypto: support OpenSSH variant of ChaCha20Poly1305 #57699 (closed)
• cmd/compile: intrinsify bits.RotateLeft32 on mipsle #39139

Related Code Changes

• crypto/cipher: make AES-GCM benchmarks match ChaCha20Poly1305 ones
• vendor/golang_org/x/crypto/chacha20poly1305: new package.

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

Comment From: cherrymui

cc @FiloSottile @rolandshoemaker @cpu @golang/security