Hey Aaron, There are probably better ways of speeding this up (e.g. my vDSO work, which should be coming back soon) than just removing rounds and hoping for the best. The problem is that there's extremely broad consensus that ChaCha20 is good at what it does. There's much less so for ChaCha8. JP's _probably_ right, and it all seems like a sensible risk analysis...maybe...but also, why play with fire? Is it really worth it? I don't think there's much harm done in being really conservative about all this. Another consideration with the RNG is that most everybody else's crypto relies on the RNG being good. If some consumer of the RNG wants to use single DES, so be it. If another consumer wants to use a cascade of ChaCha20 and AES and Serpent and Keccak for something, okay. Those aren't our choices. But we shouldn't prevent those choices by weakening the RNG. So while it *might* be kinda overkill, there's also broad consensus that what we've got is *definitely* sufficient for all uses. At the same time, it's still pretty darn fast, there exist other ways to make it faster, and I don't think it's /overly/ much. Jason
