anchor.diff:              pkt_type = aead};
   
   cipher('3des-cbc') ->
  -    #cipher{impl = des3_cbc,
  +    #cipher{impl = des_ede3_cbc,
               key_bytes = 24,
               iv_bytes = 8,
               block_bytes = 8};
  
positive.code:         <<LenData:4/binary, PayloadData/binary>>) ->
      %% Encrypt length
      IV1 = <<0:8/unit:8, Seq:8/unit:8>>,
      EncLen = crypto:crypto_one_shot(chacha20, K1, IV1, LenData, true),
      %% Encrypt payload
      IV2 = <<1:8/little-unit:8, Seq:8/unit:8>>,
      EncPayloadData = crypto:crypto_one_shot(chacha20, K2, IV2, PayloadData, true),
      %% MAC tag
      PolyKey = crypto:crypto_one_shot(chacha20, K2, <<0:8/unit:8,Seq:8/unit:8>>, <<0:32/unit:8>>, true),
      EncBytes = <<EncLen/binary,EncPayloadData/binary>>,
      Ctag = crypto:poly1305(PolyKey, EncBytes),
      %% Result
  
negative.code:              recv_sequence = Seq} = Ssh, {AAD,Ctext,Ctag}) ->
      %% The length is already decoded and used to divide the input
      %% Check the mac (important that it is timing-safe):
      PolyKey = crypto:crypto_one_time(chacha20, K2, <<0:8/unit:8,Seq:8/unit:8>>, <<0:32/unit:8>>, false),
      case equal_const_time(Ctag, crypto:poly1305(PolyKey, <<AAD/binary,Ctext/binary>>)) of
          true ->
              %% MAC is ok, decode
              IV2 = <<1:8/little-unit:8, Seq:8/unit:8>>,
              PlainText = crypto:crypto_one_time(chacha20, K2, IV2, Ctext, false),
              {Ssh, PlainText};
          false ->
             {Ssh,error}
  