[CFRG] Update of the AEGIS draft

[Frank Denis <[e-mail]>]

Hi all,

A new revision of the draft on the AEGIS family of authenticated encryption algorithms was recently published.

AEGIS is an AEAD designed for high performance applications, with significant advantages over AES-GCM:
- Fast. 2x to 4x faster than AES-GCM on CPUs with AES pipelines. Software implementations also tend to be faster
- Very simple to implement securely and efficiently using only the AES forward round function
- Reduced memory usage: doesn’t require precomputing a key schedule nor powers of the MAC key to achieve optimal performance
- Large nonce size (128 bits for AEGIS-128L, 256 bits for AEGIS-256)
- Better security bounds
- Context committing
- Backtracking resistant

In addition to internal deployments, AEGIS is already deployed in OVH routers, in the Linux kernel and in VPN software.

Multiple implementations exist (C, C++, Rust, Zig, Python, Go, Assembly), most of them having been written independently, using only the specification:
https://github.com/jedisct1/draft-aegis-aead#known-implementations
In addition to reference code and to the specification, Google’s Project Wycheproof includes an extensive set of test vectors for AEGIS.

For evaluation purposes, AEGIS can be used as an alternative to AES-GCM in the context of TLS.
In order to ensure interoperability, IANA has assigned identifiers for AEGIS-based cipher suites.
There is a maintained fork of BoringSSL that supports these cipher suites. The TLS stack of the Zig standard library also supports these suites out of the box.

Feedback would be very useful. We would love to see this document move forward.

Direct links to the draft:
- latest version (editor’s copy): https://jedisct1.github.io/draft-aegis-aead/#go.draft-irtf-cfrg-aegis-aead.html
- datatracker page: https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead

Kind regards,

-Frank.