ChaCha20Poly1305 Encryption

ChaCha20Poly1305 is the modern internet's favorite authenticated encryption: it's what TLS prefers on mobile devices, it's fast on CPUs without AES hardware, and - the important part - it authenticates as it encrypts. That means you don't just get ciphertext; you get a MAC that proves the message wasn't tampered with in transit. This node is the ARG Toolkit's way of doing real encryption inside ComfyUI - the kind where "decrypt with the wrong key" produces a hard error instead of garbage text. If your ARG or puzzle needs a message that's genuinely locked, this is the node.

The honest caveat up front: this is the fiddly end of the pack. The input slots (key, nonce, associated_data) are all BYTESLIKE with forceInput, so you must wire them from bytes-producing nodes - you can't just type into them. And unlike a lot of encryption UIs, the node does not generate a nonce for you; you have to supply one that's exactly 12 bytes. It's a real tool with real footguns, not a toy.

How it works

It wraps cryptography's aead.ChaCha20Poly1305. In encrypt mode it takes your text, encodes it to UTF-8 bytes, encrypts with the key and nonce, and returns the token base64-encoded as the encrypted_txt output. In decrypt mode it does the reverse: it base64-decodes the input, decrypts, and returns plain text. The associated_data input is authenticated-but-not-encrypted context - metadata that gets covered by the MAC without being hidden; pass None (or leave it unwired as an empty bytes) if you don't need it. The classic failure you want to see: decrypting with the wrong key or a tampered message raises an exception rather than returning garbage - that's the authentication doing its job.

The inputs that matter

• text - the message. In encrypt mode: plain text. In decrypt mode: the base64 string from a previous encryption.
• key - 32-byte encryption key, wired from the pack's ChaCha20Poly1305Keygen node (or any 32 bytes).
• nonce - exactly 12 bytes, and it must be unique per key. The pack's SystemRandom node ("Random Nonce Generator") at byte_num = 12 is the intended source - that's the same node the KDF nodes point you to.
• associated_data - optional authenticated context. Can be None.
• mode - encrypt/decrypt toggle.

Output: encrypted_txt, a string - base64 ciphertext when encrypting, plaintext when decrypting.

Installing it

Part of the ComfyUI ARG Toolkit pack. Install via ComfyUI Manager (search "ComfyUI ARG Toolkit") or:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Restart ComfyUI. This node leans on the pack's cryptography dependency (plus secretpy, stegano, invisible-watermark, reedsolo, and heavy transitives like torch and opencv-python). No models, no API keys.

Gotchas

The nonce is the #1 failure point: wrong length (must be 12 bytes) or reused across messages with the same key, and you either get an error or lose the security guarantee. Never reuse a nonce with the same key - that's the one rule of authenticated encryption that has teeth. Also remember the text side is UTF-8/base64-only, so if your message is binary, the placeholder spells out the workaround: base64 it first. And don't be alarmed when a wrong-key decrypt throws - that's the authentication layer refusing to hand you garbage, which is the feature.