This issue is meant to summarize / consolidate the secret connection conversation. (Its currently across 3 different locations) This is per discussion in the tendermint meeting today.

The current issue in secret connection is that we are relying on the salsa primitive, which has basically been abandoned in favor of chacha in many applications, such as TLS. We're also relying on the RipeMD160 primitive as a sub-component of nacl secret box.

The proposed solution is the following:

In the handshake, use a single HKDF-Sha2 invocation on the shared DH secret, local eph pubkey and remote eph pubkey to generate the secret key, send nonce, recv nonce, and challenges.

Use chacha20poly1305 as a stream cipher, via incrementing the send and recv nonces.

The only remaining question I have is that is there a need for send nonce or recv nonce to be derived from hkdf? Could it instead be that one of the two participants has their recv nonce initially as 1, and the other has their send nonce initially as 2**96 -1 and decrements their nonce. The reason I'm wondering that is that that would minimize the chance of collisions (since we're using the nonce as a stream here, and not one of the randomized nonce variants)

/cc @zmanian @tarcieri