3 ms·
I thought AES-GCM was on its way out? Isn't poly1305-chacha20 what we should use now, given that it's quite a bit cheaper in terms of cost, and the keys are muc
by sargun 11y ago
I thought AES-GCM was on its way out? Isn't poly1305-chacha20 what we should use now, given that it's quite a bit cheaper in terms of cost, and the keys are much smaller (32 bytes)?
Also, the code for chacha is easily available.
- tptacek 11y agoI definitely personally prefer ChaCha/Poly to GCM, but GCM is unfortunately quite popular right now; of the unencumbered AEADs blessed by NIST, it's very performant and thus widely implemented.
- CiPHPerCoder 11y agoAlso: Don't implement chacha20-poly1305 or AES-GCM yourself, unless you're a crypto expert. You'll more than likely make a mistake. Libsodium offers both (but AES-256-GCM is only available if you have hardware support for constant-time implementations). crypto_aead_chacha20poly1305_encrypt() crypto_aead_chacha20poly1305_decrypt() crypto_aead_aes256gcm_encrypt() crypto_aead_aes256gcm_decrypt() https://github.com/jedisct1/libsodium https://github.com/jedisct1/libsodium