4 ms·

Do you _really_ need AES256 though? Just a large computation overhead while AES128 is extraordinarily secure already. The conversation about nonce sizes is 10

Do you _really_ need AES256 though? Just a large computation overhead while AES128 is extraordinarily secure already. The conversation about nonce sizes is 100% on point however. Why isn’t it at least the size of the key?

tptacek 3y ago
Because it predates awareness of how nonce-based AEADs are misused by developers. Which, in fairness, is true of most of the first generation of AEADs, including Chapoly --- XSalsa was a clever hack, not the original design.
vlovich123 3y ago
Is AES256 meaningfully slower than AES128 when you have AES-NI extensions?
- formerly_proven 3y ago
  Nah Specifically, "nah with OpenSSL on AMD or Intel boxes from the last decade": AES-128 (ctr mode) 9.7 GB/s AES-256 (ctr mode) 8.6 GB/s (90 % as fast, not ~70 % as 10-vs-14 rounds would naively suggest) AES-128 (gcm mode) 12.4 GB/s AES-256 (gcm mode) 10.8 GB/s (plain CTR is slower than GCM because the GCM implementation in OpenSSL has received more attention than the counter mode implementation, simply because standalone counter mode is used a lot less) And this is just one core anyway. How many 100 GbE ports are you running per core? I keep reiterating this because crypto=slow is still a very common idea from the days when AES-128 would peg a core running at 40 MB/s, rcp actually was 3x faster than scp, http:// http:// instead of https:// https:// would actually meaningfully reduce load, SMB/NFS encryption would actually slow things down and it was a bog to actually use a system running with LUKS-encrypted drives. But that's not the case any more. Encryption is really really fast and has been for about ten years, depending on what you're looking at exactly. Nowadays even many microcontrollers have AES acceleration because - internet of things mainly.
  - vlovich123 3y ago
    It was a trick on my part to ask a leading question I already knew the answer to for others to provide the details as I didn’t have it handy :) Asymmetric encryption remains “slow” but symmetric is within an order of magnitude of a memcpy.
- Scarjit 3y ago
  Just doing some very quick benchmarks: https://scarjit.github.io/cryptoBench/target/criterion/report/index.html https://scarjit.github.io/cryptoBench/target/criterion/repor... It's measureable, but in most applications i wouldn't optimize this part.
  - vlovich123 3y ago
    <5% at 1 MiB (~50 us per MiB). Measurable but unlikely to be really noticeable.
NohatCoder 3y ago
AES has a key length and a round count. The speed of the cipher depend only on the round count. This suggestion takes a large key, but a moderate round count, making it only slightly slower than AES128-GCM.

tptacek 3y ago

Because it predates awareness of how nonce-based AEADs are misused by developers. Which, in fairness, is true of most of the first generation of AEADs, including Chapoly --- XSalsa was a clever hack, not the original design.

vlovich123 3y ago

Is AES256 meaningfully slower than AES128 when you have AES-NI extensions?

formerly_proven 3y ago
Nah Specifically, "nah with OpenSSL on AMD or Intel boxes from the last decade": AES-128 (ctr mode) 9.7 GB/s AES-256 (ctr mode) 8.6 GB/s (90 % as fast, not ~70 % as 10-vs-14 rounds would naively suggest) AES-128 (gcm mode) 12.4 GB/s AES-256 (gcm mode) 10.8 GB/s (plain CTR is slower than GCM because the GCM implementation in OpenSSL has received more attention than the counter mode implementation, simply because standalone counter mode is used a lot less) And this is just one core anyway. How many 100 GbE ports are you running per core? I keep reiterating this because crypto=slow is still a very common idea from the days when AES-128 would peg a core running at 40 MB/s, rcp actually was 3x faster than scp, http:// http:// instead of https:// https:// would actually meaningfully reduce load, SMB/NFS encryption would actually slow things down and it was a bog to actually use a system running with LUKS-encrypted drives. But that's not the case any more. Encryption is really really fast and has been for about ten years, depending on what you're looking at exactly. Nowadays even many microcontrollers have AES acceleration because - internet of things mainly.
- vlovich123 3y ago
  It was a trick on my part to ask a leading question I already knew the answer to for others to provide the details as I didn’t have it handy :) Asymmetric encryption remains “slow” but symmetric is within an order of magnitude of a memcpy.
Scarjit 3y ago
Just doing some very quick benchmarks: https://scarjit.github.io/cryptoBench/target/criterion/report/index.html https://scarjit.github.io/cryptoBench/target/criterion/repor... It's measureable, but in most applications i wouldn't optimize this part.
- vlovich123 3y ago
  <5% at 1 MiB (~50 us per MiB). Measurable but unlikely to be really noticeable.

NohatCoder 3y ago

AES has a key length and a round count. The speed of the cipher depend only on the round count. This suggestion takes a large key, but a moderate round count, making it only slightly slower than AES128-GCM.