Even then, they actually used a tweaked version of ChaCha20 that uses a 96-bit nonce (just barely large enough to be suitable for randomly-generated nonces) and

Even then, they actually used a tweaked version of ChaCha20 that uses a 96-bit nonce (just barely large enough to be suitable for randomly-generated nonces) and a 32-bit counter (limiting its use to 128GiB for a given nonce). Also, an extension XChaCha20 was recently published which performs an extra 20 rounds to initialize the cipher state, allowing for 192-bit nonces with no corresponding reduction in counter size. So now there's three variants of ChaCha20 * ChaCha20 (256-bit key, 64-bit nonce, 64-bit counter) * IETF ChaCha20 (256-bit key, 96-bit nonce, 32-bit counter) * XChaCha20 (256-bit key, 192-bit nonce, 64-bit counter)