Re: Packet Number Encryption Performance

[Willy Tarreau <[e-mail]>]

Hi Kazuho,

On Fri, Jun 22, 2018 at 12:22:39PM +0900, Kazuho Oku wrote:
> As stated in my previous mail, the 10% of overhead consists of three parts,
> each consuming comparable number of CPU cycles. The two among the three is
> related to the abstraction layer and how CTR is implemented, while the
> other one is the core AES-ECB operation cost.
> 
> It should be able to remove the costly abstraction layer.
> 
> It should also be possible to remove the overhead of CTR, since in PNE, we
> need to XOR at most 4 octets (applying XOR is the only difference between
> CTR and ECB). That cost should be something that should be possible to be
> nullified.
> 
> Considering these aspects, and by looking at the numbers on the OpenSSL
> source code (as well as considering the overhead of GCM), my expectation
> goes to 2% to 4%.

Well, probably that we don't need the 10 full AES rounds and could
have enough of 2 like some of the SHA3 proposals did, or even maybe
just one. These ones take a few tens of CPU cycles on modern CPUs,
possibly less, and are probably more than enough to prevent the
linkability people are concerned with.

Just my two cents.
Willy