I think I stumbled onto an issue with how ring's ChaCha20-Poly1305 behaves under Apple M5 + Rosetta.
I was debugging an obscure bug in an app that does Noise-protocol communication via snow (https://github.com/mcginty/snow). It kept getting decrypt errors when I ran it locally in Docker (image built for linux/amd64), even though the handshake succeeded. As a last resort I disabled Rosetta emulation in Docker — and the problem consistently disappeared.
I'm not a cryptography expert and leaned on Claude heavily to isolate this, so please take it with a grain of salt — but I think I have a minimal reproduction. In it, under amd64 + Rosetta on the M5, ring's ChaCha20-Poly1305:
- fails to reproduce a published Google Wycheproof vector (chacha20_poly1305_test.json, tcId 90, 513-byte plaintext), while RustCrypto's chacha20poly1305 reproduces it correctly in the same run;
- diverges from RustCrypto byte-for-byte starting at ~512-byte inputs, deterministically;
- matches everywhere when run natively on arm64.
So all signs point to Rosetta mistranslating ring's ChaCha20-Poly1305 on M5 specifically, producing wrong output for payloads from ~512 bytes up. (ring 0.17.14, macOS 26.5.2, Docker Desktop 29.6.1.)
Minimal repo (need an M5 to reproduce though):
https://github.com/hubagaspar91/rosetta-amd64-decrypt-bug
Not sure there's much to be done on your end, so this is mostly an FYI, but wanted to flag it in case you've seen it or have thoughts. Happy to run more tests - I've got the M5 handy.
I think I stumbled onto an issue with how ring's ChaCha20-Poly1305 behaves under Apple M5 + Rosetta.
I was debugging an obscure bug in an app that does Noise-protocol communication via snow (https://github.com/mcginty/snow). It kept getting decrypt errors when I ran it locally in Docker (image built for linux/amd64), even though the handshake succeeded. As a last resort I disabled Rosetta emulation in Docker — and the problem consistently disappeared.
I'm not a cryptography expert and leaned on Claude heavily to isolate this, so please take it with a grain of salt — but I think I have a minimal reproduction. In it, under amd64 + Rosetta on the M5, ring's ChaCha20-Poly1305:
So all signs point to Rosetta mistranslating ring's ChaCha20-Poly1305 on M5 specifically, producing wrong output for payloads from ~512 bytes up. (ring 0.17.14, macOS 26.5.2, Docker Desktop 29.6.1.)
Minimal repo (need an M5 to reproduce though):
https://github.com/hubagaspar91/rosetta-amd64-decrypt-bug
Not sure there's much to be done on your end, so this is mostly an FYI, but wanted to flag it in case you've seen it or have thoughts. Happy to run more tests - I've got the M5 handy.