3 ms·
It seems strange that the author is complaining about AES speed. About a year ago, I benchmarked an IPsec setup between two cheap routers with an ARM9 processo
by planckscnst 14y ago
It seems strange that the author is complaining about AES speed. About a year ago, I benchmarked an IPsec setup between two cheap routers with an ARM9 processor that did not have any special crypto blocks in it. AES significanly outperformed the other algorithms I tried.
- tptacek 14y agoYou were almost certainly benchmarking an implementation of AES that relies on table lookups for speed; those table lookups create a side channel vulnerability, which was much of the point of this article.
- planckscnst 14y agoInteresting; it was what's in the Linux kernel.
- tptacek 14y agoPretty sure that's an S-box AES. The issue is that when implemented (a) in software (b) without reliance on large lookup tables --- ie, "securely" --- AES is significantly slower.
- dchest 14y agohttp://bench.cr.yp.to/results-stream.html http://bench.cr.yp.to/results-stream.html
- tptacek 14y agoThat's a table of stream ciphers benchmarked against AES, a block cipher, in CTR mode.
- dchest 14y agoYes. Apart from disk encryption, they are pretty much interchangeable (OP talked about IPSec).
- tptacek 14y agoAES is normally benchmarked against other block ciphers. It might not be fair to compare the performance of a native stream cipher to that of AES rigged up as a stream cipher with CTR.
- floody-berry 14y agoWhat makes the comparison unfair?
- tptacek 14y agoThe other ciphers are natively stream ciphers, and AES is a block cipher adapted via CTR mode to be a stream cipher.
- floody-berry 14y agoI'm still missing what makes it unfair. Are other modes of AES potentially faster? Does AES provide something that stream ciphers don't? Are Salsa20/Chacha20 unable to be compared to anything because they're native stream ciphers that look like a block cipher in CTR mode under the hood?
- tptacek 14y ago1. Yes. 2. Yes. 3. No.