Re: [Cfrg] RG Last Call on draft-irtf-cfrg-gcmsiv-06

Andy Polyakov <> Tue, 19 September 2017 07:19 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 794FE1342C0 for <>; Tue, 19 Sep 2017 00:19:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.9
X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id jH8mL9dFYA6s for <>; Tue, 19 Sep 2017 00:19:22 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 88DCA126DFE for <>; Tue, 19 Sep 2017 00:19:22 -0700 (PDT)
Received: from [] (localhost [IPv6:::1]) by (Postfix) with ESMTP id 61F79E03C1; Tue, 19 Sep 2017 07:19:18 +0000 (UTC)
To: Watson Ladd <>
Cc: "" <>
References: <> <> <>
From: Andy Polyakov <>
Message-ID: <>
Date: Tue, 19 Sep 2017 09:19:18 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <>
Subject: Re: [Cfrg] RG Last Call on draft-irtf-cfrg-gcmsiv-06
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 19 Sep 2017 07:19:24 -0000

> I don't get a clear impression from your email what implementations
> you used or what strategies and representation.

I apologize for not being clear enough. I suppose I assumed that it's
obvious that I referred to OpenSSL implementation[s]. At least that's
what accompanying paper refers to as baseline. The absolute cycles per
byte results are quoted from <openssl>/crypto/modes/asm/,
where you can also find details about implementation techniques. Do note
that it uses reduction algorithm proposed by Shay, which he already
mentioned here in another thread.

> I'm thus extremely doubtful that your numbers below are correct: they
> may be. But I'm skeptical. Benchmarking is really hard, and I know
> I've screwed up plenty of these measurements myself.

Don't take my word for it, collect your own and tell us about it. [Do
note though that Skylake results are in perfect agreement with referred
paper. And non-Skylake results were collected using same method.]