Re: [Cfrg] questions on performance and side channel resistance for ChaCha20 and Poly1305 for IPsec and TLS

[Yoav Nir <[e-mail]>]

On 24/1/14 3:45 PM, David McGrew wrote:
> Hi Adam,
>
> On 01/23/2014 11:51 AM, Adam Langley wrote:
>> On Thu, Jan 23, 2014 at 9:54 AM, David McGrew <[e-mail]> wrote:
>>> Hi Adam and Yoav,
>>>
>>> I have some questions and comments on these crypto algorithms and 
>>> their use
>>> in TLS and IPsec.
>>>
>>> On 01/21/2014 01:06 PM, Adam Langley wrote:
>>>> On Tue, Jan 21, 2014 at 11:47 AM, Yoav Nir <[e-mail]> 
>>>> wrote:
>>>>> Reviews and comments would be greatly appreciated, as well as anyone
>>>>> checking my examples.
>>>> In the introduction: I think ChaCha20+Poly1305 are useful for software
>>>> implementations, beyond their use as a backup to AES. AES in not
>>>> suitable for pure, software implementations and they tend to be be
>>>> slow and have side-channels. (AES-GCM even more so.)
>>>
>>> The claims that ChaCha20+Poly1305 are faster than AES GCM in pure 
>>> software
>>> environments should be quantified in (at least one of) the drafts.
>> I have no problem with that, but it's not something that I typically
>> see in IETF drafts and so I didn't do any actual numbers for it.
>
> Agreed that it is not something one would expect to see in a TLS 
> draft, but if the definitive algorithm specification is going to be an 
> RFC, it should be there.   Watson suggested having a separate RFC that 
> defines this algorithm combination, which makes sense to me.

Hi David.

I'm trying to throw together a separate document describing ChaCha20, 
Poly1305, and Adam's AEAD, every step with test vectors. I hope to have 
it ready by Monday.

Yoav