# ChaCha20-Poly1305 with long nonces

OpenSSL accepts 16-byte ChaCha20-Poly1305 nonces but silently discards the first 4 bytes, breaking AEAD integrity and enabling nonce reuse.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by (vendor credit): Joran Dirk Greef of Ronomon
- Found by: jorandirkgreef
- Disclosed: 2019-09-30
- CVE: CVE-2019-1543
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/506040
- Library page: https://bugbountylibrary.com/r/h1%3A506040
- Tags: area:oss domain:oss impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high tech:linux technique:source-review vuln:crypto

**Target:** OpenSSL ChaCha20-Poly1305 AEAD cipher nonce handling
**Root cause:** OpenSSL advertises and accepts nonces up to 16 bytes (CHACHA_CTR_SIZE) for ChaCha20-Poly1305, but the spec allows only 12 bytes; the first 4 bytes are silently discarded rather than rejected.
**Steps:**
1. Pass a 16-byte nonce to OpenSSL's ChaCha20-Poly1305 AEAD API.
2. Observe OpenSSL accepts it without error.
3. Note the first 4 bytes of the nonce are discarded and not authenticated.
4. Tamper with 4 bytes of the AEAD message or reuse nonces differing only in the discarded 4 bytes.
**How found:** Researcher compared OpenSSL's documented 16-byte nonce support (CHACHA_CTR_SIZE) against the ChaCha20-Poly1305 spec's 12-byte limit and tested what OpenSSL does with a 16-byte nonce.
**Exploitation:** Attacker can tamper with 4 bytes of the AEAD message undetected, or exploit nonce reuse (e.g. 32-bit counter in a 16-byte buffer) to fully decrypt sensitive data.
**Insight:** When a library's documented constant exceeds the underlying spec's limit, test what happens to the excess bytes—silent truncation of nonce/IV bytes breaks AEAD integrity and can cause nonce reuse.