Clarification needed on AEAD robustness documentation.

[GPUex]

In AEAD documentation, there is proposed fix for AEAD robustness: H(key, nonce || ciphertext_tag || ad).
1st question: ciphertext_tag here means entire ciphertext and its tag or the tag alone?
2nd question: does key has to be exactly the same as used in AEAD, or can it be derived from the same keying material as AEAD key?
3rd question on H function - can it be BLAKE2b or BLAKE3 in keyed mode?

[jedisct1]

1st question: ciphertext_tag here means entire ciphertext and its tag or the tag alone?

The tag alone is enough.

2nd question: does key has to be exactly the same as used in AEAD, or can it be derived from the same keying material as AEAD key?

A derived key is fine, and actually cleaner than reusing the key.

3rd question on H function - can it be BLAKE2b or BLAKE3 in keyed mode?

Yes, just use crypto_generichash.