4 ms·

If the selling point is “faster,” you’d better wonder why that wasn’t the standard already in use. Because “fast enough” is fast enough, unless it isn’t. My d

If the selling point is “faster,” you’d better wonder why that wasn’t the standard already in use. Because “fast enough” is fast enough, unless it isn’t. My desktop CPU has AES in hardware, so it’s fast enough to just run AES. My phone’s ARM CPU doesn’t have AES in hardware, so it’s not fast enough. ChaCha20 is fast enough, though, and especially with the SIMD support on most ARM processors. All this paper is saying is that ChaCha20 is not fast enough for some devices, and so folks had to put in intellectual effort to make a new thing that is. But even further: everyone’s definition for “fast enough” is different. Cycles per byte matters more if you encrypt a lot of bytes.

adrian_b 1y ago
Only extremely old ARM CPUs (i.e. 32-bit CPUs from more than a decade ago) do not have AES hardware. All 64-bit ARM CPUs have it, like also at least the HW for SHA-1 and SHA-256. The more recent ARM CPUs have HW support for more cryptographic algorithms than the majority of the desktop CPUs. "Lightweight" cryptography is not intended for something as powerful as a smartphone, but only for microcontrollers that are embedded in small appliances, e.g. sensors that transmit wirelessly the acquired data.
- throw0101c 1y ago
  > Only extremely old ARM CPUs (i.e. 32-bit CPUs from more than a decade ago) do not have AES hardware. I remember when Sun announced the UltraSPARC T2 in 2007 which had on-die hardware for (3)DES, AES, SHA, RSA, etc: * https://en.wikipedia.org/wiki/UltraSPARC_T2 https://en.wikipedia.org/wiki/UltraSPARC_T2 (It also had two 10 GigE modules right on the chip.)
- ack_complete 1y ago
  Not all 64-bit ARM CPUs have AES support since it's part of the optional Crypto extension. The BCM2837 in the Raspberry Pi 4 is an ARMv8 CPU that lacks it.
  - adrian_b 1y ago
    You are right that the cryptographic instructions are optional and they have always been so in ARM CPUs, in order to enable the making of CPUs that can be embedded in products that will be exported even to destinations where cryptography is forbidden. However the poster above was talking about smartphone Arm-based CPUs. I doubt that there has ever existed a 64-bit ARM-based CPU for smartphones that did not implement the cryptography extension. Even the CPUs having only Cortex-A53 cores that I am aware of, made by some Chinese companies for extremely cheap mobile phones, had this extension.
- conradev 1y ago
  I think I’m just getting old. I have a collection of KaiOS phones with Cortex-A7s but now they’re over a decade old :( Newer ones have the Qualcomm 215, which, yes, is 64-bit 4x A53 From that perspective, LWC is only useful on old (existing?) microcontrollers: the Cortex-A320 that came out this year is 64-bit. Hardware cycles take time, though, and it will be some time before everything is 64-bit!

adrian_b 1y ago

Only extremely old ARM CPUs (i.e. 32-bit CPUs from more than a decade ago) do not have AES hardware. All 64-bit ARM CPUs have it, like also at least the HW for SHA-1 and SHA-256. The more recent ARM CPUs have HW support for more cryptographic algorithms than the majority of the desktop CPUs. "Lightweight" cryptography is not intended for something as powerful as a smartphone, but only for microcontrollers that are embedded in small appliances, e.g. sensors that transmit wirelessly the acquired data.

throw0101c 1y ago
> Only extremely old ARM CPUs (i.e. 32-bit CPUs from more than a decade ago) do not have AES hardware. I remember when Sun announced the UltraSPARC T2 in 2007 which had on-die hardware for (3)DES, AES, SHA, RSA, etc: * https://en.wikipedia.org/wiki/UltraSPARC_T2 https://en.wikipedia.org/wiki/UltraSPARC_T2 (It also had two 10 GigE modules right on the chip.)
ack_complete 1y ago
Not all 64-bit ARM CPUs have AES support since it's part of the optional Crypto extension. The BCM2837 in the Raspberry Pi 4 is an ARMv8 CPU that lacks it.
- adrian_b 1y ago
  You are right that the cryptographic instructions are optional and they have always been so in ARM CPUs, in order to enable the making of CPUs that can be embedded in products that will be exported even to destinations where cryptography is forbidden. However the poster above was talking about smartphone Arm-based CPUs. I doubt that there has ever existed a 64-bit ARM-based CPU for smartphones that did not implement the cryptography extension. Even the CPUs having only Cortex-A53 cores that I am aware of, made by some Chinese companies for extremely cheap mobile phones, had this extension.
conradev 1y ago
I think I’m just getting old. I have a collection of KaiOS phones with Cortex-A7s but now they’re over a decade old :( Newer ones have the Qualcomm 215, which, yes, is 64-bit 4x A53 From that perspective, LWC is only useful on old (existing?) microcontrollers: the Cortex-A320 that came out this year is 64-bit. Hardware cycles take time, though, and it will be some time before everything is 64-bit!