Symmetric encryption algorithms with large IVs and authentication? Most modern symmetric ciphers require a nonce/IV.  If the nonce is reused, security is lost.

If the nonce is large enough, it can be generated securely by using a CSPRNG.  This avoids needing to keep state between encryptions.  I am looking for algorithms that


have a large IV &mdash; specifically, one large enough that using a CSPRNG
to generate a fresh IV each time is secure.
provide authentication.
have easy-to-use, well-regarded, portable open-source implementations that
are resistant to timing attacks.


The reason for these requirements is that I am looking for an implementation that is (relatively) hard to misuse and works just about anywhere &mdash; and that is written by an expert cryptographer.

I have some ideas (such as encrypting a randomly-generated 512 bit IV with a single round of ChaCha20 &ndash; and then transmitting it) but I am not a cryptographer so I don't trust them.
Let's look at your requirements:


  have a large IV — specifically, one large enough that using a CSPRNG to generate a fresh IV each time is secure.


Generally, IVs/nonces longer than 96 bits are thought to be okay for random generation. If it is at least 128 bits you can safely use it as long as you can a 128-bit block cipher like AES, because before you run into random nonce collisions you already have random block collisions.

Shorter nonces, such as the 64-bit nonce in Salsa20 and ChaCha cannot be used as freely, since you would expect a collision after a few billion ($10^9$) messages and after just millions with non-negligible probability.


  provide authentication.


Unless you want to compose your own authenticated encryption using a cipher and a MAC, this basically leaves you with one option that is in common use: AES-GCM. ChaCha20Poly1305 is also in common use (TLS), but has a short 64-bit nonce. XSalsa20Poly1305, which CodesInChaos mentions, is also an option, but basically only used in NaCl/libsodium as far as I know.

The X in XSalsa20 is important. That algorithm has a 192-bit nonce. That long nonce allows you to e.g. use a 128-bit random value and a 64-bit timestamp, making collisions unlikely even in the case of a deficient RNG.


  have easy-to-use, well-regarded, portable open-source implementations that are resistant to timing attacks.


This is a bit off topic here, but again, AES-GCM and XSalsa20Poly1305 both have open source implementations. E.g. libsodium has implementations of both.




  I have some ideas (such as encrypting a randomly-generated 512 bit IV with a single round of ChaCha20 – and then transmitting it) but I am not a cryptographer so I don't trust them.


This does not seem to accomplish anything. IVs do not need to be secret and ChaCha20 itself requires a (short) nonce.