Re: [Cfrg] RG Last Call on draft-irtf-cfrg-gcmsiv-06

[Andy Polyakov <[e-mail]>]

> I don't get a clear impression from your email what implementations
> you used or what strategies and representation.

I apologize for not being clear enough. I suppose I assumed that it's
obvious that I referred to OpenSSL implementation[s]. At least that's
what accompanying paper refers to as baseline. The absolute cycles per
byte results are quoted from <openssl>/crypto/modes/asm/ghash-x86_64.pl,
where you can also find details about implementation techniques. Do note
that it uses reduction algorithm proposed by Shay, which he already
mentioned here in another thread.

> I'm thus extremely doubtful that your numbers below are correct: they
> may be. But I'm skeptical. Benchmarking is really hard, and I know
> I've screwed up plenty of these measurements myself.

Don't take my word for it, collect your own and tell us about it. [Do
note though that Skylake results are in perfect agreement with referred
paper. And non-Skylake results were collected using same method.]