[CFRG] Comment on draft-irtf-cfrg-vdaf

[Gilles VAN ASSCHE <[e-mail]>]

Hi Chris,

I just wanted to comment on something you wrote recently about draft-irtf-cfrg-vdaf and its use of TurboSHAKE:

> I'll add my own data point: draft-irtf-cfrg-vdaf. This draft specifies an incremental distributed point function (IDPF), a type of function secret sharing used in some MPC protocols. Most of the computation is spent on XOF evaluation. For performance reasons, we try to use AES wherever we can in order to get hardware support. We end up with a mix of TurboSHAKE128 and AES, which is not ideal. It would be much nicer if we could afford to use a dedicated XOF, but TurboSHAKE128 is not fast enough in software.

A simple way to improve the throughput of TurboSHAKE's output in this application would be to use it in counter mode. This would allow platforms that support SIMD instructions to get a significant speed-up (e.g., 3× with AVX2 on a typical Haswell or Skylake architecture).

More specifically, this would work like XofFixedKeyAes128 to produce a fixed key. But, instead of using AES in counter mode, you could concatenate the outputs of TurboSHAKE128(fixed key || i, D, 168) with i a running counter coded on a fixed number of bits and D an available domain separation value. Parallelizing using SIMD instructions then becomes straightforward.

Kind regards,
Gilles