Question about nonce size in xchacha20poly1305

[sinolopes]

Hello,

I noticed that in the xchacha20poly1305 library version 0.10.1, the nonces used are 19 bytes long, whereas the XChaCha20-Poly1305 specification (RFC 7539) recommends nonces of 24 bytes. Why was this difference in nonce size chosen in this particular implementation?

I'm curious to understand the reasons behind this choice and whether there are specific security, performance, or interoperability considerations that led to this decision.

Thank you for your time and clarification on this matter.

let nonce: [u8; 19] = generate_nonce();

///should work with this code:
///let nonce: [u8; 24] = generate_nonce();

let key: [u8; 32] = generate_key();
let aead = XChaCha20Poly1305::new(key.as_ref().into());

let mut stream_encryptor = stream::EncryptorBE32::from_aead(aead, nonce.as_ref().into());

[tarcieri]

The STREAM encryptor manages a portion of the nonce for you. Namely the “BE32” flavor of STREAM uses a 32-bit counter and 1-byte last block flag. 24 - 4 - 1 = 19

[sinolopes]

thank you very much for your response