# Salsa20 expands a 256-bit key and a 64-bit nonce into a 2^70 byte stream - where did the 2^70 come from?

From Section 3.1 in DJB's document on The Salsa20 family of stream ciphers- https://cr.yp.to/snuffle/salsafamily-20071225.pdf

Salsa20 expands a 256-bit key and a 64-bit nonce (unique message number) into a $$2^{70}$$-byte stream.

Where does this $$2^{70}$$ number come from?

Salsa20 is a PRF working in Counter-mode. That is it generates the keystream as $$K_i=F_k(N,\text{Counter}_i)$$.
This Counter is a 64-bit value - not the nonce - thus allowing $$2^{64}$$ invocations of the PRF before repetition. Each PRF invocation yields 64 bytes, so in total $$2^{64}\cdot 64=2^{70}$$ bytes.