Re: [TLS] Salsa20 and Poly1305 in TLS

[Adam Langley <[e-mail]>]

On Mon, Jul 29, 2013 at 11:03 PM, Ted Krovetz <[e-mail]> wrote:
> In an attempt to simplify from UMAC, I developed VMAC as an alternative that uses considerably less internal key and is significantly faster on 64-bit architectures. Even from L3 cache it is probably 2-3 times faster than Poly1305.
>
> http://fastcrypto.org/vmac/
> http://krovetz.net/csus/papers/vhash-revise.pdf
> http://krovetz.net/csus/papers/vmac.pdf

I agree that VMAC has considerably less memory footprint, around 168
bytes in total, and is faster. I will try to repeat the above
benchmarks for VMAC this week. (And, hopefully, run some tests on
ARM.)

> I'd also suggest using Bernstein's Chacha instead of Bernstein's Salsa. It has the same core as Salsa, but Bernstein cleaned up the rough edges of its prolog and epilog, making it smaller, faster and nicer to program. Chacha is basically a better Salsa.
>
> http://cr.yp.to/chacha.html

I do like ChaCha more than Salsa. However, in this case we don't have
the theoretical foundations of polynomial authenticators to stand on.
Salsa is what gets reviewed, ChaCha has had relatively little
attention. The improvement from Salsa to ChaCha doesn't seem to be
large enough to justify switching.

Having said that, I'm fine with either.


Cheers

AGL