On Thu, Jan 27, 2022 at 05:04:07PM +0800, Sandy Harris wrote: > Current code in extract_buf() declares a local struct blake2s_state, > calls blake2s_init() which uses initialisation constants Which is good, because BLAKE2s is defined to use certain constants. If different constants were used, then it wouldn't be BLAKE2s anymore, but rather some homebrew crypto with unknown security properties (like the old "SHA-1" that wasn't really SHA-1). > and moves data into the chacha state with memcpy(). It's actually XOR'd in. Please take a closer look at crng_reseed(). - Eric
