A "properly" implemented 16 bit Salsa20 would have 64/128 bits of key, which would still take a very long time to break. The reason _this_ implementation was br

A "properly" implemented 16 bit Salsa20 would have 64/128 bits of key, which would still take a very long time to break. The reason _this_ implementation was broken (assuming the referenced snippet [1] is accurate) is the rotl function and the rotation values. The shifts are being calculated for 32 bits but are being used with 16 bit values. Instead of all 16 bits being rotated and used, half the shifts result in 0 while the others affect only a handful of high bits, which means there is very little diffusion going on. [1]: https://gist.githubusercontent.com/extremecoders-re/499d461753b50998f81c9011895f10fe/raw/49cd11f2e82767ab0df04f04506feb60c63d919b/borkedsalsasnip.c https://gist.githubusercontent.com/extremecoders-re/499d4617...