Re: [Cfrg] RG Last Call on draft-irtf-cfrg-gcmsiv-06

[Andy Polyakov <[e-mail]>]

> If Andy says that there is likely no long-term performance benefit to using POLYVAL rather than GHASH, then I think this is probably right.

I don't feel that it's what I tried to say, not exactly. I said that
reported 20% improvement is rather anomaly than rule in the POLYVAL vs.
GHASH case, and it wouldn't be sustainable practice if decisions are
based on anomalies. Because anomalies tend to be resolved. In other
words long-run term of mental equation is rather how decisions are made,
than POLYVAL performance per se. As for POLYVAL per se. I'm not saying
that it doesn't offer *any* performance benefit, only that it doesn't on
some platforms, and that in non-anomalous cases it would be far from
"overwhelming". As additional couple of data points I've just collected
results for Cortex-A53, 6%, and Cortex-A57, 0%. It's common big.LITTLE
pair with A53 being "little". [Yes, equivalent of PCLMULQDQ was used. If
it wasn't, difference would be hardly measurable.]

> Before going further with the RFC, could the gcmsiv authors please address the long-term cost vs benefit of using POLYVAL and the modified CTR rather than GHASH and standard CTR?

In the context what I'm also trying to say/imply/suggest is that *mode*
specification is not necessarily right place to introduce primitives.