3 ms·

Have you thought about Chacha20/Poly1305-based analogues to the algorithms you implemented, per https://github.com/briansmith/ring/issues/413 https://github.com

Have you thought about Chacha20/Poly1305-based analogues to the algorithms you implemented, per https://github.com/briansmith/ring/issues/413 https://github.com/briansmith/ring/issues/413? Is AES-SIV mainly better because it is specified, and thus has seen more analysis, or are there other reasons that Chacha20/Poly1305 aren't taking off in this space?

ktta 9y ago
Hardware instructions for AES and GHASH make AES-GCM faster than ChaCha20-Poly1305. Apparently the most popular cipher mode used in TLS is AES-GCM and has seen a lot of attention, including its inclusion in the linux kernel[1]. OTOH, ChaCha20-Poly1305 is used for mobile, for example by Google[2]. [1]: https://lwn.net/Articles/666509/ https://lwn.net/Articles/666509/ [2]: https://security.googleblog.com/2014/04/speeding-up-and-strengthening-https.html https://security.googleblog.com/2014/04/speeding-up-and-stre...
bascule 9y ago
As you guessed, my main reason is there aren't standard constructions around SIV modes for ChaCha20Poly1305, although as Brian Smith notes in that thread SIV is a general construction which should be easy to adapt. See my comments in that same thread for some early hints at Miscreant. AES is also more ubiquitously available in hardware, which is nice when targeting slower devices like embedded/IoT.