Subject: Re: [Cfrg] RG Last Call on draft-irtf-cfrg-gcmsiv-06
From: Ted Krovetz <[email-masked]>
To: [email-masked]
Cc: Andy Polyakov <[email-masked]>
Date: Mon, 18 Sep 2017 12:14:51 -0700
List-Id: Crypto Forum Research Group <cfrg.irtf.org>

For those unfamiliar with Andy's work, he is the primary contributor of assembly-language implementations to OpenSSL. For example, most of these were written by him and are first-rate.

https://github.com/openssl/openssl/tree/master/crypto/aes/asm
https://github.com/openssl/openssl/tree/master/crypto/modes/asm

If Andy says that there is likely no long-term performance benefit to using POLYVAL rather than GHASH, then I think this is probably right.

Before going further with the RFC, could the gcmsiv authors please address the long-term cost vs benefit of using POLYVAL and the modified CTR rather than GHASH and standard CTR?

Thanks,
Ted