Security of ChaChaPoly (IETF rfc7539) in the noise protocol framework of the Lightning Network

Question

According to this paper ChaChaPoly is secure against chosen known plaintext attacks. I wonder however if that security assumption is weakened by a lot since messages sent on the transport layer of the lightning network start with a 16 bit length field with an HMAC coming from ChaChaPoly. (They are then followed by the actual lightning message, followed by an HMAC for the payload which I don't care about at this time)

As there is only a small fixed set of potential lengths of lightning messages, we can guess the plaintext of the length field. In particular, I wonder what is the impact of doing a block cipher like ChaChaPoly as defined here on 16 bit data for which the plaintext is potentially known?

As mentioned before, I am not an expert on cryptography but I am not sure if this particular setup does not yield a compromise of security of the Transport layer, potentially exposing session keys which would allow an attacker to decrypt up to 500 messages or even spoof data. Has anyone ever looked into this or can give me a reason why our setup does not yield a security problem?

Answer 1

The paper you cited proves that ChaChaPoly is IND-CCA secure. This notion of security seems to perfectly cover your attack if I read the definition right (https://en.wikipedia.org/wiki/Ciphertext_indistinguishability): "A cryptosystem is considered secure in terms of indistinguishability if no adversary, given an encryption of a message randomly chosen from a two-element message space determined by the adversary, can identify the message choice with probability significantly better than that of random guessing (​1⁄2).".

That is, even if just two such lengths existed, the adversary cannot guess which one is encrypted here significantly better than randomly.