Some of the encrypted messenger apps and password managers use extended version of Bernstein's ciphers and some of them not.
Viber-Salsa20
Wire-ChaCha20
Threema-XSalsa20
Sid-Salsa20
Nordpass-XChaCha20
Keepass-ChaCha20
Why? Does larger nonce make extended version more secure? if it is then why some of them not using extended one? or Can we say extended and non extended versions have equal security level?
The only difference is that XChaCha uses a 192-bit nonce rather than a 64-bit nonce. This allows you to use a random nonce without worrying about the risks of nonce-reuse, which makes picking nonces significantly easier and safer. The core of the cipher (the public permutation) is unchanged.
XChaCha is built on top of HChaCha:
XChaCha20 can be constructed from an existing ChaCha20 implementation and HChaCha20. All one needs to do is:
Pass the key and the first 16 bytes of the 24-byte nonce to HChaCha20 to obtain the subkey.
Use the subkey and remaining 8 byte nonce with ChaCha20 as normal (prefixed by 4 NUL bytes, since [RFC8439] specifies a 12-byte nonce).
And HChaCha is a small tweak to ChaCha:
HChaCha20 is initialized the same way as the ChaCha cipher, except that HChaCha20 uses a 128-bit nonce and has no counter. Instead, the block counter is replaced by the first 32 bits of the nonce.
Original ChaCha uses a 64-bit nonce and a 64-bit counter. IETF ChaCha uses a 96-bit nonce and a 32-bit counter (the larger nonce is so it can be generated randomly in TLS, and the smaller counter is acceptable because TLS records are limited to 16 KiB). XChaCha gets the best of both words, with a 192-bit nonce and a 64-bit counter. It's design is identical to that of XSalsa20, but with the ChaCha core. As the core is just a public permutation, the security proof for XSalsa20 applies to XChaCha.
