related blog post from agl: <a href="https://www.imperialviolet.org/2013/10/07/chacha20.html" rel="nofollow">https://www.imperialviolet.org/2013/10/07/chacha20.html</a>
I think it's an interesting idea, but I admit I'm a bit surprised at the choice of ChaCha20. The related Salsa20 algorithm has received far more public analysis and while ChaCha20 has some interesting (if minor) performance and theoretical security improvements, but they don't seem worth giving up the assurance you get from the extra review of Salsa20.
why does DJ Bernstein advocate using a counter for <i>r</i> (see section 3 of the poly1305 paper)? this RFC uses a random value (derived from the one-time key), which seems reasonable to me (i think there are 106 bits available, so you're getting a collision in 53 bits, which at 1000 connections a second is over 10^5 years).<p>just seems odd to go to the effort of specifying how to safely implement a counter in some detail in the paper when a random value seems fine (it's also quite possible i've misunderstood something - these are all new to me).