Change |CRYPTO_chacha_20| to use 96-bit nonces, 32-bit counters.

The new function |CRYPTO_chacha_96_bit_nonce_from_64_bit_nonce| can be
used to adapt code from that uses 64 bit nonces, in a way that is
compatible with the old semantics.

Change-Id: I83d5b2d482e006e82982f58c9f981e8078c3e1b0
Reviewed-by: Adam Langley <>
diff --git a/include/openssl/chacha.h b/include/openssl/chacha.h
index b7f5882..64713c2 100644
--- a/include/openssl/chacha.h
+++ b/include/openssl/chacha.h
@@ -27,7 +27,7 @@
  * initial block counter is specified by |counter|. */
 OPENSSL_EXPORT void CRYPTO_chacha_20(uint8_t *out, const uint8_t *in,
                                      size_t in_len, const uint8_t key[32],
-                                     const uint8_t nonce[8], size_t counter);
+                                     const uint8_t nonce[12], uint32_t counter);
 #if defined(__cplusplus)