IETF Logo Mail Archive

Re: [hybi] AES-CTR is darned fast (was Re: Masking overhead with measurements and code)

Willy Tarreau <w@1wt.eu> Sun, 09 January 2011 20:26 UTC

Return-Path: <w@1wt.eu>
X-Original-To: hybi@core3.amsl.com
Delivered-To: hybi@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AD7933A683D for <hybi@core3.amsl.com>; Sun, 9 Jan 2011 12:26:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.085
X-Spam-Level:
X-Spam-Status: No, score=-2.085 tagged_above=-999 required=5 tests=[AWL=-0.042, BAYES_00=-2.599, HELO_IS_SMALL6=0.556]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FBA4Ud1G1tVy for <hybi@core3.amsl.com>; Sun, 9 Jan 2011 12:26:19 -0800 (PST)
Received: from 1wt.eu (1wt.eu [62.212.114.60]) by core3.amsl.com (Postfix) with ESMTP id 4CD4B3A67D4 for <hybi@ietf.org>; Sun, 9 Jan 2011 12:26:19 -0800 (PST)
Received: (from willy@localhost) by mail.home.local (8.14.4/8.14.4/Submit) id p09KSR2C009675; Sun, 9 Jan 2011 21:28:27 +0100
Date: Sun, 09 Jan 2011 21:28:27 +0100
From: Willy Tarreau <w@1wt.eu>
To: Maciej Stachowiak <mjs@apple.com>
Message-ID: <20110109202827.GS5743@1wt.eu>
References: <20110108111632.GI2479@1wt.eu> <1294531527.7650.535.camel@ds9.ducksong.com> <56F80FB9-DAAD-40CA-92E8-21390546851B@apple.com> <20110109143423.GM5743@1wt.eu> <BDA504E6-A722-4513-A660-467E22140958@apple.com> <20110109200346.GR5743@1wt.eu> <DB77A28F-CE0C-4AAF-AB4E-7DBE06D4D1D8@apple.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <DB77A28F-CE0C-4AAF-AB4E-7DBE06D4D1D8@apple.com>
User-Agent: Mutt/1.4.2.3i
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] AES-CTR is darned fast (was Re: Masking overhead with measurements and code)
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 09 Jan 2011 20:26:21 -0000

On Sun, Jan 09, 2011 at 12:22:22PM -0800, Maciej Stachowiak wrote:
> I think your conclusion here is wrong. AES-CTR does not repeat the key
> schedule on any fixed cycle, as I understand it.

I've never said that. The fact that it *does not* repeat the key
precisely is what makes it harder to get the expected pattern.

> It generates a psuedorandom non-repeating keystream.

Exactly. And in a pseudorandom keystream, a given 32-bit pattern
will appear once in 16GB, and could appear once in a cleaverly
built 4GB stream too.

> Your analysis was for a repeating 160-bit mask. I'm not sure I
> am convinced by the rest of your analysis, but it doesn't apply
> to AES-CTR.

The program does not appear to AES-CTR, but the base of the analysis
definitely does : we can get a parsable HTTP request that at least
one known intermediary is able to process in 2^32 32-bit patterns.

Regards,
Willy

v2.23.0 | Report a Bug | By Email