[CFRG] Re: Comment on draft-irtf-cfrg-vdaf

[Christopher Patton <[e-mail]>]

Thanks Gilles, this is a great suggestion. I'll benchmark and report back.

Chris P.

On Tue, Aug 20, 2024 at 8:17 AM Gilles VAN ASSCHE <gilles.vanassche=
[e-mail]> wrote:

> Hi Chris,
>
> I just wanted to comment on something you wrote recently about
> draft-irtf-cfrg-vdaf and its use of TurboSHAKE:
>
> > I'll add my own data point: draft-irtf-cfrg-vdaf. This draft specifies
> an incremental distributed point function (IDPF), a type of function secret
> sharing used in some MPC protocols. Most of the computation is spent on XOF
> evaluation. For performance reasons, we try to use AES wherever we can in
> order to get hardware support. We end up with a mix of TurboSHAKE128 and
> AES, which is not ideal. It would be much nicer if we could afford to use a
> dedicated XOF, but TurboSHAKE128 is not fast enough in software.
>
> A simple way to improve the throughput of TurboSHAKE's output in this
> application would be to use it in counter mode. This would allow platforms
> that support SIMD instructions to get a significant speed-up (e.g., 3× with
> AVX2 on a typical Haswell or Skylake architecture).
>
> More specifically, this would work like XofFixedKeyAes128 to produce a
> fixed key. But, instead of using AES in counter mode, you could concatenate
> the outputs of TurboSHAKE128(fixed key || i, D, 168) with i a running
> counter coded on a fixed number of bits and D an available domain
> separation value. Parallelizing using SIMD instructions then becomes
> straightforward.
>
> Kind regards,
> Gilles
>
>