Re: [Cfrg] questions on performance and side channel resistance for ChaCha20 and Poly1305 for IPsec and TLS

David McGrew <mcgrew@cisco.com> Fri, 24 January 2014 14:33 UTC

Return-Path: <mcgrew@cisco.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 953E41A0442 for <cfrg@ietfa.amsl.com>; Fri, 24 Jan 2014 06:33:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.036
X-Spam-Level:
X-Spam-Status: No, score=-10.036 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dhrv1qkHP0fm for <cfrg@ietfa.amsl.com>; Fri, 24 Jan 2014 06:33:07 -0800 (PST)
Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) by ietfa.amsl.com (Postfix) with ESMTP id 9303E1A00F2 for <cfrg@irtf.org>; Fri, 24 Jan 2014 06:33:07 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1322; q=dns/txt; s=iport; t=1390573987; x=1391783587; h=message-id:date:from:mime-version:to:cc:subject: references:in-reply-to:content-transfer-encoding; bh=zFm3uhUC6STZb+ZZxe2X6HEECtFtigg7gdf7PXXEYrI=; b=KLbceFh9YQ2PSB+Z/Zd7hWD2I6XWywghRlkmfpznwoTx+8djuAV6aEkK XTSlWbn56HKK/E0LhwW2JUohzJoAu4emWgzr5H0XZLIHFrK/WJweBvhUY cXYgsHcRDEaMw1g2XOetlvhELs4s0Xhjfs0mXPa7Bq41PTO3GwQXRX3yz 4=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Ag0FAL9s4lKQ/khM/2dsb2JhbABagwyEDLk4gQsWdIIlAQEBAwEjFUABEAsOCgICBRYEBwICCQMCAQIBRQYNAQUCAhaHYwirOZxpF4EpjWMHgm+BSQEDiUiOX4ZHi1eBb4FcHg
X-IronPort-AV: E=Sophos;i="4.95,712,1384300800"; d="scan'208";a="4133756"
Received: from ams-core-3.cisco.com ([144.254.72.76]) by aer-iport-1.cisco.com with ESMTP; 24 Jan 2014 14:33:05 +0000
Received: from [10.0.2.15] ([10.148.144.89]) by ams-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id s0OEX5JE009532; Fri, 24 Jan 2014 14:33:05 GMT
Message-ID: <52E279A1.2040300@cisco.com>
Date: Fri, 24 Jan 2014 09:33:05 -0500
From: David McGrew <mcgrew@cisco.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130922 Icedove/17.0.9
MIME-Version: 1.0
To: Robert Ransom <rransom.8774@gmail.com>
References: <180998C7-B6E5-489E-9C79-80D9CAC0DE68@checkpoint.com> <CAL9PXLy9hrq+i_neP96FbTJRvRLbLEXnMYdBdwSeHunFAwF+jQ@mail.gmail.com> <A867BB8E-4556-44B1-A0AF-16771626BF5C@checkpoint.com> <52CB358D.3050603@cisco.com> <A6BDE08D-1F7D-4813-A9C4-61AF8C14412B@checkpoint.com> <52CB482D.6090807@cisco.com> <09031D92-9A14-4CF0-A000-123E71D4F784@checkpoint.com> <3861F1D4-B412-42BE-AE6C-FF5DE213854C@checkpoint.com> <CAL9PXLzgo5a2dk0JM-kWvawPhO1arpurcYSuqcffTWGdrCGY7A@mail.gmail.com> <52E12D1F.80701@cisco.com> <CABqy+sqbOBcezgBiKE7ZyWjVVPf84XyU=ktk0DtKq=EHkqjN0w@mail.gmail.com>
In-Reply-To: <CABqy+sqbOBcezgBiKE7ZyWjVVPf84XyU=ktk0DtKq=EHkqjN0w@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: "cfrg@irtf.org" <cfrg@irtf.org>, Adam Langley <agl@google.com>
Subject: Re: [Cfrg] questions on performance and side channel resistance for ChaCha20 and Poly1305 for IPsec and TLS
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 24 Jan 2014 14:33:09 -0000

Hi Robert,

On 01/23/2014 01:26 PM, Robert Ransom wrote:
> On 1/23/14, David McGrew <mcgrew@cisco.com> wrote:
>
>> Another goal for this ciphersuite is to avoid side channel attacks,
>> though it is not directly mentioned in the draft.    The design
>> rationale for Salsa describes how timing channels are avoided by not
>> using multiplication in that function.   However, Poly1305 uses *lots*
>> of multiplication operations, by a fixed constant.  Unless I am missing
>> something, this is an inconsistency with the motivation for the
>> ciphersuite.  In any case, if Poly1305 requires implementation
>> techniques to avoid side channels, they should be documented in the
>> draft that specifies that function.
> Dr. Bernstein's original implementation of Poly1305 used the IA-32
> floating-point unit to avoid timing leaks on the processors available
> in 2005.  My understanding is that essentially all modern processors
> have constant-time integer multipliers, so special implementation
> techniques are no longer required.

this would be great news.   The issue does deserve to be documented, 
though, even if we can cite a study that shows that current processors 
don't have the issue, since future processors might behave differently.

thanks,

David

>
>
> Robert Ransom
> .
>