IETF Logo Mail Archive

Re: [hybi] AES-CTR is darned fast (was Re: Masking overhead with measurements and code)

Maciej Stachowiak <mjs@apple.com> Sun, 09 January 2011 20:32 UTC

Return-Path: <mjs@apple.com>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6E9F63A684B for <hybi@core3.amsl.com>; Sun, 9 Jan 2011 12:32:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.539
X-Spam-Level:
X-Spam-Status: No, score=-106.539 tagged_above=-999 required=5 tests=[AWL=0.060, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sBox9n4f4eZG for <hybi@core3.amsl.com>; Sun, 9 Jan 2011 12:32:27 -0800 (PST)
Received: from mail-out3.apple.com (mail-out3.apple.com [17.254.13.22]) by core3.amsl.com (Postfix) with ESMTP id 88F493A684A for <hybi@ietf.org>; Sun, 9 Jan 2011 12:32:27 -0800 (PST)
Received: from relay14.apple.com (relay14.apple.com [17.128.113.52]) by mail-out3.apple.com (Postfix) with ESMTP id 79D02C5E7BA2 for <hybi@ietf.org>; Sun, 9 Jan 2011 12:34:39 -0800 (PST)
X-AuditID: 11807134-b7cfdae000001831-df-4d2a1bdf7c93
Received: from et.apple.com (et.apple.com [17.151.62.12]) by relay14.apple.com (Apple SCV relay) with SMTP id 6F.6A.06193.FDB1A2D4; Sun, 9 Jan 2011 12:34:39 -0800 (PST)
MIME-version: 1.0
Content-transfer-encoding: 7bit
Content-type: text/plain; charset="us-ascii"
Received: from [17.153.103.151] by et.apple.com (Sun Java(tm) System Messaging Server 6.3-7.04 (built Sep 26 2008; 32bit)) with ESMTPSA id <0LER00L49VTP6250@et.apple.com> for hybi@ietf.org; Sun, 09 Jan 2011 12:34:39 -0800 (PST)
From: Maciej Stachowiak <mjs@apple.com>
In-reply-to: <20110109202827.GS5743@1wt.eu>
Date: Sun, 09 Jan 2011 12:34:37 -0800
Message-id: <AB4429EC-1F62-483A-8731-33343B096DA0@apple.com>
References: <20110108111632.GI2479@1wt.eu> <1294531527.7650.535.camel@ds9.ducksong.com> <56F80FB9-DAAD-40CA-92E8-21390546851B@apple.com> <20110109143423.GM5743@1wt.eu> <BDA504E6-A722-4513-A660-467E22140958@apple.com> <20110109200346.GR5743@1wt.eu> <DB77A28F-CE0C-4AAF-AB4E-7DBE06D4D1D8@apple.com> <20110109202827.GS5743@1wt.eu>
To: Willy Tarreau <w@1wt.eu>
X-Mailer: Apple Mail (2.1082)
X-Brightmail-Tracker: AAAAAA==
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] AES-CTR is darned fast (was Re: Masking overhead with measurements and code)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 09 Jan 2011 20:32:28 -0000

On Jan 9, 2011, at 12:28 PM, Willy Tarreau wrote:

> On Sun, Jan 09, 2011 at 12:22:22PM -0800, Maciej Stachowiak wrote:
>> I think your conclusion here is wrong. AES-CTR does not repeat the key
>> schedule on any fixed cycle, as I understand it.
> 
> I've never said that. The fact that it *does not* repeat the key
> precisely is what makes it harder to get the expected pattern.
> 
>> It generates a psuedorandom non-repeating keystream.
> 
> Exactly. And in a pseudorandom keystream, a given 32-bit pattern
> will appear once in 16GB, and could appear once in a cleaverly
> built 4GB stream too.

There's no way to guarantee that a chosen 32-bit pattern will appear anywhere in AES-CTR output for an attacker-controlled input. It could appear 0 times, no matter what the input is. So your claim is false.

Regards,
Maciej

v2.23.0 | Report a Bug | By Email