I want to use BouncyCastle to immitate the default AEAD scheme of libsodium (X25519 ECDH followed by XSalsa20 symmetric cipher with Poly1305 KDF).

I was able to do the DH with X25519 KeyAgreement to generate a javax.crypto.SecretKey.

But for the next step I’m left clueless. BouncyCastle offers a ChaCha20Poly1305 class implementing AEADCipher, which seems to be doing both steps at once (generating MAC and encrypting). However, I did not find any such equivalent for “XSalsa20Poly1305”.

There is a Poly1305KeyGenerator available in BC, but I don’t see any way to pass a nonce to it, since it accepts only a simple KeyGenerationParameters objects on init.

Why is the combination of ChaCha20 and Poly1305 so special (compared to [X]Salsa20+Poly1305) that it has a dedicated implementation? How can I do the same thing for XSalsa20 with BouncyCastle primitives?