Hacker News Reader

Genuine question; I wonder why OpenSSL deviates from the spec by allowing anything other than a 96 bit nonce.

Just a theory, but I think the author who introduced this deviation, may have confused the nonce length for ChaCha20 (16-bytes) with the nonce length for ChaCha20-Poly1305 (12-bytes), reusing CHACHA_CTR_SIZE for both.

It's 12 bytes for both.

Reply on news.ycombinator.com