6 ms·
The difference is that for GCM and OCB nonces with lengths different from 96 bits are defined (albeit not recommended), whereas Chacha20-Poly1305 doesn't suppor
by blattimwind 8y ago
The difference is that for GCM and OCB nonces with lengths different from 96 bits are defined (albeit not recommended), whereas Chacha20-Poly1305 doesn't support that in the first place.
The bug isn't OpenSSL throwing bytes away, the bug is OpenSSL acting as-if anything other than 96 bit nonces are acceptable.