[X]ChaCha20+Poly1305 usable?

Hey there.

When using LUKS with integrity protection, there used to be that
problem that some of the available "well known" algos SHOULDN'T be used
because of security reasons, e.g.:

- --cipher aes-gcm-random --integrity aead
  => nonce in the kernel's GCM only 96 bit, considered too small

- --cipher chacha20-random --integrity poly1305
  => the same than above was used to be said, though when looking at:
     /proc/crypto:
     name         : chacha20
     driver       : chacha20-simd
     module       : chacha_x86_64
     priority     : 300
     refcnt       : 1
     selftest     : passed
     internal     : no
     type         : skcipher
     async        : no
     blocksize    : 1
     min keysize  : 32
     max keysize  : 32
     ivsize       : 16
		=> doesn't that mean the nonce is 16*8 = 128 bit,
                   which is the same than e.g. that of AEGIS128?
                   OTOH, linux/include/crypto/chacha.h defines
                   #define CHACHAPOLY_IV_SIZE	12
     chunksize    : 64
     walksize     : 64


But since quite a while now there's XChaCha20 in the kernel:
https://github.com/torvalds/linux/commit/de61d7ae5d3789dcba3749a418f76613fbee8414
which should have a 192bits nonce.

Wouldn't that solve the issues with the too small nonce?

At least it seems I cannot create such a LUKS volume:
# cryptsetup --verbose --type luks2  --cipher xchacha20-random  --integrity poly1305   luksFormat TEST ; echo $?
WARNING: Device TEST already contains a 'crypto_LUKS' superblock signature.
Cipher xchacha20-random (key size 256 bits) is not available.
Command failed with code -1 (wrong or missing parameters).


btw, does it make (security-wise) any sense to use ChaCha20 without
integrity? e.g.:
--cipher xchacha20-random
--cipher xchacha20-xts-random
seem to work, but
--cipher xchacha20-xts-plain64

doesn't.


Thanks,
Chris.