Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Call sodium_init(), skip AES-256-GCM benchmark if not supported
--- Regarding sodium_init() --- From https://libsodium.gitbook.io/doc/usage: sodium_init() initializes the library and should be called before any other function provided by Sodium. Interestingly, only the ChaCha20-Poly1305 benchmark was severely affected by the missing initialization: ~20 seconds instead of ~6.5 on my machine. --- Regarding AES-256-GCM --- From https://libsodium.gitbook.io/doc/secret-key_cryptography/aead/aes-256-gcm: The current implementation of this construction is hardware-accelerated and requires the Intel SSSE3 extensions, as well as the aesni and pclmul instructions. Intel Westmere processors (introduced in 2010) and newer meet the requirements. There are no plans to support non hardware-accelerated implementations of AES-GCM. If portability is a concern, use ChaCha20-Poly1305 instead. Before using the functions below, hardware support for AES can be checked with: int crypto_aead_aes256gcm_is_available(void); The function returns 1 if the current CPU supports the AES256-GCM implementation, and 0 if it doesn't. The library must have been initialized with sodium_init() prior to calling this function.
- Loading branch information
3e5ec2e
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If speed is a concern, you may want to use
crypto_aead_aegis256_*()
available in the current development code of libsodium.3e5ec2e
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Awesome, thank you very much for your suggestion!
We're actually already quite happy with libsodium's results:
There's clearly something wrong with wolfCrypt's results, but right now we're definitely thinking about switching from OpenSSL to libsodium in Mumble.
crypto_aead_aegis256_*()
is only for AES-256 (AEAD), correct? Is there something we can do in order to improve ChaCha20-Poly1305's performance?3e5ec2e
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
crypto_aead_aegis256
uses the AES core function in a mode that leverages the parallelism of modern CPUs. It's about 2 to 3 times faster than AES256-GCM on Intel and ARM CPUs.3e5ec2e
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Wow, that's a huge improvement.
Can something similar be applied to ChaCha20-Poly1305 as well?
3e5ec2e
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Unfortunately not.
3e5ec2e
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Considering that our packets are quite small (< 500 bytes), would you choose AES-256-GCM or ChaCha20-Poly1305?
3e5ec2e
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If you need something that works on a wide range of platforms, use ChaChaPoly.
AES-GCM is also tricky to use correctly outside TLS.
AES-OCB has patents issues.
3e5ec2e
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For anyone passing by, the discussion is at mumble-voip/mumble#3918.