> Two rounds of XChaCha12 are followed by an AES-256 encryption, but of just 16 bytes<p>I am not a cryptographer so I am a bit clueless on topics like this but I am wondering, why are they doing this? Does this provide any significant benefit to just chacha12 or chacha12 + poly1305?
I'd be really interested to try out a Go port of this. Given that Adiantum is a construction built from existing primitives, should I expect that it won't be difficult to port?