[technion]

Aes has a blocksize of 128bits, which so 96 bit is the nonce size that gets you a 32 bit counter. You probably don't want a smaller counter. Things xsalsa technically have a larger nonce but in reality still derive a smaller nonce.

[tptacek]

Right, but the larger key (in XSalsa and X-everything-else) effectively gets mixed into the key, which is fine.