title: How to set the block counter for chacha20-poly1305 in pycryptodome
body: <p>I am currently trying to decrypt OpenSSH packets, which are encrypted using chacha20-poly1305. Until now I can decrypt the packet length and check the MAC (I am using pycryptodome) but when I try to decrypt the payload it only return garbled output.</p>
  
  <p>I am decrypting the length using:</p>
  
  <pre><code>    nonce = int(seqnr).to_bytes(8, 'big')  
      cipher_len = ChaCha20.new(key=key1_hex, nonce=nonce)  
      length = cipher_len.decrypt(binascii.a2b_hex(cipher[:8]))  
  </code></pre>
  
  <p>whereas seqnr is the packet sequence number, key1_hex is the hex representation of the second part of the encryption key and cipher[:8] is the first 4 bytes of the packet.<br>
  This works fine!</p>
  
  <p>Now I continued to decrypt using the first part of the encryption key the same nonce and the payload:</p>
  
  <pre><code>        cipher_chacha = ChaCha20.new(key=key2_hex, nonce=int(seqnr).to_bytes(8, 'big'))
          ciphertext = cipher_chacha.decrypt(binascii.a2b_hex(cipher[8:-32]))
  </code></pre>
  
  <p>After this <a href="https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.chacha20poly1305" rel="nofollow noreferrer">https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.chacha20poly1305</a> document, from the openssh github site tells me that I have to use for the decryption of the payload a block counter of 1. But in the documentation on <a href="https://pycryptodome.readthedocs.io/en/latest/src/cipher/chacha20_poly1305.html#chacha20-poly1305" rel="nofollow noreferrer">https://pycryptodome.readthedocs.io/en/latest/src/cipher/chacha20_poly1305.html#chacha20-poly1305</a> there does not seem to be an option to define the block counter number (It seems like it starts default at 0 because the verification of the tag worked for me).<br>
  Is this true? Or am I missing something?
  Until now it does not work and I am pretty sure it has to be because of the wrong start of the block counter.</p>
  
  <p>Edit:
  The solution is to call cipher_chacha.seek(64) before decrypting! Then it will start at block counter 1!</p>