Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
From Section 3.1 in DJB's document on The Salsa20 family of stream ciphers- https://cr.yp.to/snuffle/salsafamily-20071225.pdf
Salsa20 expands a 256-bit key and a 64-bit nonce (unique message number) into a $2^{70}$-byte stream.
Where does this $2^{70}$ number come from?
Salsa20 is a PRF working in Counter-mode. That is it generates the keystream as $K_i=F_k(N,\text{Counter}_i)$.
This Counter is a 64-bit value - not the nonce - thus allowing $2^{64}$ invocations of the PRF before repetition. Each PRF invocation yields 64 bytes, so in total $2^{64}\cdot 64=2^{70}$ bytes.
Salsa20 generates the stream in 64-byte (512-bit) blocks. Each block is an independent hash of the key, the nonce, and a 64-bit block number; there is no chaining from one block to the next.
The above is the relevant quote from the paper, about five lines below the quote in the question.
