Re: [TLS] ChaCha20 + Poly1305 in TLS

[Yoav Nir <[e-mail]>]

On Sep 10, 2013, at 6:22 PM, Adam Langley <[e-mail]> wrote:

> The following numbers are encryption rates for a 1K block size with
> with AES-128-GCM or ChaCha20+Poly1305. The AES-128-GCM implementation
> is OpenSSL 1.0.1e compiled with gcc 4.6.3 and -O3, unless other
> compiler flags are noted.
> 
> On an E5-2690@2.90GHz with Hyperthreading and Turboboost disabled:
> 
> AES-128-GCM, AES-NI disabled: 131 MB/s
> AES-128-GCM, AES-NI enabled: 311 MB/s
> AES-128-GCM, AES-NI enabled & -march=native: 308 MB/s
> ChaCha20+Poly1305: 420 MB/s
> ChaCha20+Poly1305, -march=native: 560 MB/s
> 
> On a Galaxy Nexus (ARM Cortex-A9@1.2GHz), gcc 4.7:
> 
> AES-128-GCM: 27 MB/s
> ChaCha20+Poly1305: 78 MB/s
> 
> Note that I'm being rather unfair to ChaCha20 here: I'm comparing
> 128-bit AES against a 256-bit ChaCha20.
> 
> Intel suggests[5] that an E5-2690 (Sandy Bridge) should be able to do
> AES-128-GCM in ~2.55 cycles/byte, giving speeds of ~1.1GB/s. Possibly
> I've messed something up with OpenSSL, or the implementation in
> OpenSSL 1.0.1e is underperforming, but I'm reporting what I see.

I'm seeing 500 MB/s for AES-GCM on an Intel E5645@2.40Ghz, which is an older Westmere with a somewhat slower clock speed and OpenSSL 1.0.1-something. If I had to guess, you're using the MMX version of the ghash/gmult functions rather than the PCLMULQDQ version. 

Regardless, we need an alternative to AES. RC4 is out because of security, and 3DES is around a tenth the speed. Going back to 3DES means your hardware is not strong enough to handle your current load. ChaCha+poly1305 seems to be a good fallback, so I support the publication.

Yoav