Subject: [CFRG] [RFC] AEGIS

From: Frank Denis <[email-masked]>
Date: Fri, 31 Dec 2021 00:54:44 +0100

Hi everybody,

An initial version of a draft documenting the AEGIS AEADs was just published:

https://www.ietf.org/archive/id/draft-denis-aegis-aead-00.html

The original version of AEGIS was published in 2014, then updated for the CAESAR competition that it eventually became a finalist of, for high-performance applications. Since then, AEGIS variants have consistently remained among the fastest performers of the Supercop benchmark.

Even on high-end CPUs, there’s a need for faster alternatives to AES-GCM. 6G networks were a justification for the ROCCA cipher (based on AEGIS) but more broadly, as service providers converge towards encrypting all data at-rest and in-transit, the ability to process more data per CPU core is extremely useful.

AEGIS leverages a large inner state and was designed to maximize usage of pipelined implementations of the AES permutation, which allow for the parallel computation of several AES rounds.

All the AEGIS variants don’t require carry-less multiplications, and are very simple to implement efficiently.

On Intel, PowerPC and ARM CPUs with AES acceleration, they are more than 2x faster than their AES-GCM counterparts.

They also have a large nonce size (128 or 256 bits), making them safer to use than AES-GCM in non-TLS contexts.

AEGIS already found its way into the Linux kernel (for dm-crypt) and routers (OVH OTB). Independent implementations in various languages have been written. However, no document ensuring the interoperability of these implementations was previously published.

Would documenting the AEGIS AEADs be something that CFRG members could possibly help work on/review?

Thank you,

-Frank.