4 ms·
The first paragraph makes no sense that's true, but what follows is a good point. AES-GCM is much much faster than ChaCha20-Poly1305. If: 1) your market is fr
by ccktlmazeltov 7y ago
The first paragraph makes no sense that's true, but what follows is a good point. AES-GCM is much much faster than ChaCha20-Poly1305.
If:
1) your market is fragmented
2) many clients are cheap phones that don't support AES-NI
3) you can differentiate them so that you don't penalize better clients
Then yeah it makes sense to use Chacha20-Poly1305 for some of these clients.
But choosing Chacha20-Poly1305 over AES-GCM all the time doesn't, and I'm not sure why Wireguard does that (besides trying to be trendy).
- cakoose 7y agoSure, that's a fine argument to make. But the article says "I expect AES to outperform ChaCha20 in every single scenario", even when the very next sentence talks about a scenario where that's not true.
- cyphar 7y agoIt's to make the design simpler. If you only use one crypto algorithm there's no cipher suite negotiation in the protocol (and thus no downgrade attacks). And while AES-GCM is faster with AES-NI, ChaCha20-Poly1305 is constructed to avoid timing side-channels (so software implementations are automatically much safer by default).
- ccktlmazeltov 7y agoI would expect most clients to have hardware support for AES-GCM.
- cyphar 7y agoThat's only true if most of your clients aren't mobile devices. That's why Google pushed for ChaCha20-Poly1305 standardisation and usage with TLS several years ago.
- fmajid 7y agoChaCha20-Poly1305 outperforms AES on mobile devices where it matters most. The article espouses a desktop-centric view of the world that is completely obsolete.
- ccktlmazeltov 7y agoIt doesn't though, most mobile devices today have hardware support for AES.
- floatboth 7y ago> cheap phones that don't support AES-NI Which are those mythical cheap phones? All the Qualcomm chips from the last N years have AES instructions, right?
- ccktlmazeltov 7y agoThink India
- vetinari 7y ago4) you have customers with DSL or cable, with cheap routers, that run some 800 MHz MIPS or ARMv6 CPU. Dual core, if they are lucky. Think of the tp-links and netgears out there. Compared to these routers, you average cheap cellphone is overpowered. 800 Mhz single or dual core is circa 2012 smartphone. And this is on the gateway, not on the client, potentially serving several clients. Chacha20-Poly1305 absolutely murders AES there. AES won't even saturate 20MBit+ upload.