When reading about different algorithms, I often encounter claims that various algorithms are "fast in software" (e.g. Salsa20) or "fast in hardware" (e.g. DES). What properties make a cipher relatively faster in hardware or faster in software? Why would something be fast to implement in hardware but much slower in a software implementation?
$\begingroup$
$\endgroup$
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
"In software" means programming the cipher on a multifunctional processor or smart chip. The normal instruction set is used to build the algorithm, and not available operations have to be emulated. "In hardware" means building the cipher in real hardware, like on a Field-programmable gate array (FPGA) or Application-specific integrated circuit (ASIC). (Nearly?) all ciphers are faster in hardware than in software, but we say "fast in software" if an algorithm is not much slower in software than in hardware.
Some operations can be done fast in software, some other are hard to emulate for the typical x86 (or x86-64) processor. A few examples:
- Bit shifting (with a constant length) is one of the fastest things in hardware. You can just connect the outputs with the appropiate inputs on the silicon, no transistors needed. Only the speed of the input / output and the current limits this kind of operation, while in software you have to "waste" an entire CPU cycle.
- Additions are pretty fast in software, because that's what processors are made for. Higher integer performance was the main goal of CPU optimizations in the past and is even now of high priority. Additionally it's pretty costly to implement big bit size adder because of the carry over. All this makes addition preferable for software implementation.
- Permutations are slow in software, but very fast in hardware. It's the same like bit shifting in hardware, but slow in software because there's no specialized operation for permutations. It has to be emulated, and that's pretty costly. Here's a document about fast software permutation instructions. With this a CPU could be much faster at this task.
Other important factors are as example Pipelining. This can enhance the performance on hardware (and limited in software) and reduce the needed area of the chip. All this factors lead to the fact that some ciphers are "faster in hardware" than "in software" or the other way round.
$\begingroup$
$\endgroup$
"Software" in this case generally refers to software with few threads, but possibly quite a lot of memory accesses/bandwidth required. Memory bandwidth is expensive in die area, so hardware isn't suited to things that use tons of memory. eg scrypt requires quite a lot of memory, bcrypt makes a lot of data-dependent memory reads, etc. You CAN make hardware to make such things fast, but it's generally very expensive. It's often cheaper to just buy commodity systems in bulk and use a normal software solution.
Hardware on the other hand tends to be good at massively parallel processing or at massively pipelined processing. If you've got a stream of data and want to run a fixed set of instructions on it, DSPs are great. SIMD is an area where hardware is necessary and will always be faster than running the same thing on a system with a more limited number of threads (eg a 16-thread 8-core processor vs a few thousand threads of a GPU). The limitation of hardware there is the "single instruction" bit, it's much harder to make hardware which can change what instruction is used based on the data.
So effectively, it's not "fast in software vs fast in hardware" it's "cheap in software vs cheap in hardware." You can do anything at the same speed in either if you have enough money, but money is very, very important.
