3 ms·
It's to make the design simpler. If you only use one crypto algorithm there's no cipher suite negotiation in the protocol (and thus no downgrade attacks). And w
by cyphar 7y ago
It's to make the design simpler. If you only use one crypto algorithm there's no cipher suite negotiation in the protocol (and thus no downgrade attacks). And while AES-GCM is faster with AES-NI, ChaCha20-Poly1305 is constructed to avoid timing side-channels (so software implementations are automatically much safer by default).
- ccktlmazeltov 7y agoI would expect most clients to have hardware support for AES-GCM.
- cyphar 7y agoThat's only true if most of your clients aren't mobile devices. That's why Google pushed for ChaCha20-Poly1305 standardisation and usage with TLS several years ago.