Subject: Re: [Cfrg] Can ChaCha20 be recommended for deployments?

From: Yoav Nir <[email-masked]>
Date: Mon, 3 Aug 2015 20:45:26 +0300

I stand corrected. 

I guess I didn’t expect to have hardware acceleration for AES.

Yoav

> On Jul 30, 2015, at 6:18 PM, Derek Atkins <[email-masked]> wrote:
> 
> Yoav Nir <[email-masked]> writes:
> 
>> On Jul 28, 2015, at 11:15 PM, Simon Josefsson <[email-masked]> wrote:
>> 
>>> Counter-question: what alternative to AES-GCM would be better suited?
>>> Or even nearly as well suited as ChaCha20-Poly1305?  I can only think of
>>> AES in some other AEAD mode, or more slower/exotic/older alternatives
>>> like Camellia, but none rank as high in the trust/speed matrix as
>>> ChaCha20-Poly1305 to me.
>> 
>> Hi, Simon
>> 
>> In IoT applications the go-to cipher has been AES-CCM. It’s slower
>> than AES-GCM, but it has the advantage that you only need the AES
>> encrypt function.
> 
> Actually, in our implementation and testing (where we have AES-ECB in
> hardware for assistance), GCM is orders of magnitude slower than CCM
> because we can't easily implement the GF field math in our environment.
> So I would not agree with your characterization that CCM is slower than
> GCM.
> 
> (Technically we've implemented CTR+CMAC, not CCM, but I think my
> argument remains the same and is still correct)
> 
> -derek
> -- 
>       Derek Atkins                 617-623-3745
>       [email-masked]             www.ihtfp.com
>       Computer and Internet Security Consultant