ChaCha12-BLAKE3: Secure, Simple and Fast authenticated and committing encryption(kerkour.com)
kerkour.com
ChaCha12-BLAKE3: Secure, Simple and Fast authenticated and committing encryption
https://kerkour.com/chacha12-blake3
1 comments
There's already ChaCha20-Poly1305-SIV which is way more elegant: https://github.com/C2SP/C2SP/blob/main/chacha20-poly1305-siv...
Interesting construction, thank you for sharing!
But:
- More and more people see ChaCha20 as wasteful (too many rounds)
- Poly1305 is "hard" to implement
- ChaCha12 + BLAKE3 can fulfill all the symmetric cryptography needs (MAC, AEAD, Hash, RNG...), which is untrue of ChaCha20 + Poly1305, therefore simplifying the deployment of secure cryptography
- ChaCha12 + BLAKE3 both scales with the width of SIMD vectors, opening the door to really really fast cryptography on general-purpose hardware, especially with ARM SVE & SVE2
- SIV construction requires to decrypt the entire payload before being able to verify the authentication tag, which can be costly and may lead to DoS attacks due to the asymmetry of the cost of attack / cost of defense
But:
- More and more people see ChaCha20 as wasteful (too many rounds)
- Poly1305 is "hard" to implement
- ChaCha12 + BLAKE3 can fulfill all the symmetric cryptography needs (MAC, AEAD, Hash, RNG...), which is untrue of ChaCha20 + Poly1305, therefore simplifying the deployment of secure cryptography
- ChaCha12 + BLAKE3 both scales with the width of SIMD vectors, opening the door to really really fast cryptography on general-purpose hardware, especially with ARM SVE & SVE2
- SIV construction requires to decrypt the entire payload before being able to verify the authentication tag, which can be costly and may lead to DoS attacks due to the asymmetry of the cost of attack / cost of defense
Poly1305 is straightforward to implement and also scales with the width of SIMD vectors, just like other polynomial-based MACs. BLAKE3 is nice but tricky to implement and optimize; a textbook implementation performs very poorly.
Avoid using Rust implementations for serious benchmarks, especially in the context of symmetric cryptography.
For really fast ciphers on general-purpose hardware, check out AEGIS and HiAE. https://github.com/hiae-aead/benchmarks https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/ https://datatracker.ietf.org/doc/draft-pham-cfrg-hiae/
Avoid using Rust implementations for serious benchmarks, especially in the context of symmetric cryptography.
For really fast ciphers on general-purpose hardware, check out AEGIS and HiAE. https://github.com/hiae-aead/benchmarks https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/ https://datatracker.ietf.org/doc/draft-pham-cfrg-hiae/