According to this paper ChaChaPoly is secure against chosen known plaintext attacks. I wonder however if that security assumption is weakened by a lot since messages sent on the transport layer of the lightning network start with a 16 bit length field with an HMAC coming from ChaChaPoly. (They are then followed by the actual lightning message, followed by an HMAC for the payload which I don't care about at this time)
As there is only a small fixed set of potential lengths of lightning messages, we can guess the plaintext of the length field. In particular, I wonder what is the impact of doing a block cipher like ChaChaPoly as defined here on 16 bit data for which the plaintext is potentially known?
As mentioned before, I am not an expert on cryptography but I am not sure if this particular setup does not yield a compromise of security of the Transport layer, potentially exposing session keys which would allow an attacker to decrypt up to 500 messages or even spoof data. Has anyone ever looked into this or can give me a reason why our setup does not yield a security problem?