> Do they really? Absolutely: > […] However, XChaCha20 is currently not widely implemented outside the libsodium library, due to the absence of formal specifi

> Do they really? Absolutely: > […] However, XChaCha20 is currently not widely implemented outside the libsodium library, due to the absence of formal specification. https://download.libsodium.org/doc/advanced/xchacha20.html https://download.libsodium.org/doc/advanced/xchacha20.html Can't say for sure, but it look like they didn't have an independent implementation to compare to. Just like me a few months a go. --- > What about timing attacks? Monocypher is immune. First, the primitive were chosen precisely because they are easily immunised against timing attacks. Second, this is easily checked simply by looking at the source code: no secret-dependent branches, no secret-dependent indices, and that's about it. One doesn't need to be an expert to check that, a junior programmer could do it after being told what to look for.