> Anyway applying the mask is pointless, dangerous, and took 45+ minutes to audit. It's not pointless. It facilitates 32-bit limbs¹, which are simpler to impl

> Anyway applying the mask is pointless, dangerous, and took 45+ minutes to audit. It's not pointless. It facilitates 32-bit limbs¹, which are simpler to implement than 26-bit limbs. (And faster on modern intel processors. My implementation² beats both libsodium and donna by a slight margin.) If you use 26-bit limbs (as they probably do like everyone else), it is still not pointless: it's the only way to conform to official tests vectors and other Poly1305 implementations, making their implementation more reliable than it would be without them. It's also not dangerous, as DJB himself proved in his paper —unless one is uncomfortable with those security margins? [1]: http://loup-vaillant.fr/tutorials/poly1305-design http://loup-vaillant.fr/tutorials/poly1305-design (search "Restricting R") [2]: http://loup-vaillant.fr/projects/monocypher/ http://loup-vaillant.fr/projects/monocypher/ --- I can't fathom why they chose AES over Chacha20, though. Do they plan to rely on bit slicing? Chacha20 would be much simpler than that, and faster too. And if they absolutely want random nonces, they could have just used XSalsa20. (New projects can now use XChacha20, but that may not have been reasonable until a few months ago.)