From the original paper: > ChaCha20-Poly1305 [30] directly uses the sequence number in its key derivation, which makes it vulnerable to our prefix truncation a

From the original paper: > ChaCha20-Poly1305 [30] directly uses the sequence number in its key derivation, which makes it vulnerable to our prefix truncation attack... > Note that the fault is not with ChaCha20-Poly1305 as an AEAD encryption scheme, but with its integration into the SSH secure channel construction. See here: https://terrapin-attack.com/TerrapinAttack.pdf https://terrapin-attack.com/TerrapinAttack.pdf