Re: [Cfrg] questions on performance and side channel resistance for ChaCha20 and Poly1305 for IPsec and TLS

[David McGrew <[e-mail]>]

On 01/24/2014 06:19 PM, Yoav Nir wrote:
> On 24/1/14 3:45 PM, David McGrew wrote:
>> Hi Adam,
>>
>> On 01/23/2014 11:51 AM, Adam Langley wrote:
>>> On Thu, Jan 23, 2014 at 9:54 AM, David McGrew <[e-mail]> wrote:
>>>> Hi Adam and Yoav,
>>>>
>>>> I have some questions and comments on these crypto algorithms and 
>>>> their use
>>>> in TLS and IPsec.
>>>>
>>>> On 01/21/2014 01:06 PM, Adam Langley wrote:
>>>>> On Tue, Jan 21, 2014 at 11:47 AM, Yoav Nir <[e-mail]> 
>>>>> wrote:
>>>>>> Reviews and comments would be greatly appreciated, as well as anyone
>>>>>> checking my examples.
>>>>> In the introduction: I think ChaCha20+Poly1305 are useful for 
>>>>> software
>>>>> implementations, beyond their use as a backup to AES. AES in not
>>>>> suitable for pure, software implementations and they tend to be be
>>>>> slow and have side-channels. (AES-GCM even more so.)
>>>>
>>>> The claims that ChaCha20+Poly1305 are faster than AES GCM in pure 
>>>> software
>>>> environments should be quantified in (at least one of) the drafts.
>>> I have no problem with that, but it's not something that I typically
>>> see in IETF drafts and so I didn't do any actual numbers for it.
>>
>> Agreed that it is not something one would expect to see in a TLS 
>> draft, but if the definitive algorithm specification is going to be 
>> an RFC, it should be there.   Watson suggested having a separate RFC 
>> that defines this algorithm combination, which makes sense to me.
>
> Hi David.
>
> I'm trying to throw together a separate document describing ChaCha20, 
> Poly1305, and Adam's AEAD, every step with test vectors. I hope to 
> have it ready by Monday.
>
> Yoav
>
>

Thanks Yoav, I offer to provide some detailed comments.   Can I ask for 
some other volunteers in the group to do the same?    It would be good 
to make sure that the review gets done in a timely way, considering the 
IETF interest.

David