Re: Packet number encryption

[Mikkel Fahnøe Jørgensen <[e-mail]>]

The overhead of packet encryption (single block AES-CTR) is probably around
100 cycles with AES-NI and possibly 160 cycles table based for one block
for Intel arch. This is because parallel multi-block optimisations are not
possible. AES-CTR of one block is about the same as AES-CTR of 4 blocks,
and GCM auth tag adds perhaps 50% to that. Thus packet number encryption
might be twice as fast as AES-GCM of a 64 byte message which is still a 50%
overhead.


The overhead could be reduced by generating an AES derived random byte
sequence and store 8 bits from the sequence in each packet. The sequence
can be efficiently precomputed for 64 packets at a time. A simple lookup
table will tell the packet number with high probability, and if it fails,
it is possible to extend the search. Details could be discussed, such as
using 12 bits instead of 8 etc.

This requires fewer header bits on the wire, is private, ossification
resistant, and fast.