Re: [TLS] Salsa20 and Poly1305 in TLS

[Ted Krovetz <[e-mail]>]

> However, I believe that Poly1305 is superior to UMAC and we're looking
> at Salsa20/12+Poly1305, not UMAC. (Note: that's Poly1305 with the
> nonce generated directly by Salsa20/12, not via AES.)

The key agility in a simple poly hash is certainly much better than that of UMAC, and I agree that UMAC is not appropriate for some usage scenarios. I don't know enough about TLS usage, however, to comment on whether UMAC is a bad choice.

A couple of alternatives that may be worth considering...

--

In an attempt to simplify from UMAC, I developed VMAC as an alternative that uses considerably less internal key and is significantly faster on 64-bit architectures. Even from L3 cache it is probably 2-3 times faster than Poly1305.

http://fastcrypto.org/vmac/
http://krovetz.net/csus/papers/vhash-revise.pdf
http://krovetz.net/csus/papers/vmac.pdf

--

I'd also suggest using Bernstein's Chacha instead of Bernstein's Salsa. It has the same core as Salsa, but Bernstein cleaned up the rough edges of its prolog and epilog, making it smaller, faster and nicer to program. Chacha is basically a better Salsa.

http://cr.yp.to/chacha.html

-Ted