> Chacha20 tends to be naturally immune to timing attacks on most platforms, while AES requires special care if you don't have hardware support. One of the nic

> Chacha20 tends to be naturally immune to timing attacks on most platforms, while AES requires special care if you don't have hardware support. One of the nice things about the crypto designed by djb is the effort to make it easy to implement safely. For example, as mentioned, Chacha20 is designed to avoid timing attacks. Curve25519 is designed so every 32 byte key is a valid public key. Just like programming languages are shifting from the C like view of it is solely the programmer’s responsibility to avoid screwing up, to languages like rust which emphasize safety and make it harder to have an inadvertent memory safety issue, so our crypto algorithms ideally should be designed that an competent general software engineer can implement them without screwing up.