I need to encrypt 168bit messages, the ciphertext should, preferably, match the plaintext size. Message Authentication and Integrity is not a must, but a really important should. My first idea was using AES-GCM-SIV, but performance is a thing. the software will run on a mini PC (Older RaspberryPi) and will need to encrypt a message every second and decrypt around 10 messages a second. The code will be written in C++ and the encryption and decryption will both run in their own threads. A new key will be used every day.
With the importance of performance in my mind, I began to look at ChaCha20, specifically ChaCha20-Poly1305.
I came to the following conclusion:
ChaCha20-Poly1305: Ciphertext Size: ChaCha20-Poly1305 produces ciphertext that includes the encrypted message and a 128-bit (16-byte) Poly1305 authentication tag appended to it. So, the ciphertext size is larger than the plaintext size due to this added authentication tag.
AES-GCM-SIV: Ciphertext Size: AES-SIV modes combine encryption and authentication, and they do not produce a separate authentication tag. The ciphertext size is the same as the plaintext size.
Comparison for a 168-bit message:
Ciphertext Size: 168 bits (message) + 128 bits (Poly1305 authentication tag) = 296 bits. Faster than AES-GCM-SIV, but a reused nonce is a serious threat.
Ciphertext Size: 168 bits (message) = 168 bits. Slower than ChaCha20-Poly1305, a reused nonce is not a big issue.
My questions are:
Is this conclusion correct?
Will the speed of AES-GCM-SIV cipher be a bottleneck?
If you have a suggestion for a better cipher, please feel free to share it!