1
$\begingroup$

I have read about the speed performance of AES_128_GCM on specific processors Intel and AMD that support AES New Instruction set. As compared with CMAC and HMAC is it relatively slow for other processors such as ARM9 board or cryptographic hardware?

$\endgroup$
  • $\begingroup$ I don't have hard data at hand. But I think GMAC is faster than at least HMAC and likely faster than CMAC, which both rely on primitives, whereas GMAC "only" needs one 128-bit field multiplication (IIRC). $\endgroup$ – SEJPM Jul 23 '15 at 16:22
  • $\begingroup$ Thank you for your reply. @SEJPM In preliminary tests I made on GMAC, i have observed low execution speed in cryptographic hardware. That is why I was curious to know other's experience. $\endgroup$ – hab Jul 24 '15 at 9:49
2
$\begingroup$

GCM is sometimes called a 1.5 pass AEAD cipher, where the CTR encryption counts for 1 and the GMAC counts for 0.5. So you would indeed expect it to be faster than encryption + CMAC and HMAC with regards to the amount of CPU instructions.

That is: as long as the encryption is using AES for both solutions. GCM requires a 128 bit block cipher while CMAC and HMAC could also work with a fast stream cipher.

If the hardware however doesn't support 32 bit multiplications the speed may drop significantly, so it's not that great on embedded processors with a 8 or 16 bit ALU. ARM however is 32 (for ARM9) or 64 bit so it should be relatively fast on one.

Note that there may be rather big differences with regards to implementation. It's definitely recommended not to take anything for granted and test which authenticated cipher is fastest in practice.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thank you for your explanation @Maarten Bodewes. In (en.wikipedia.org/wiki/AES_instruction_set) " In AES-NI Performance Analyzed, Patrick Schmid and Achim Roos found, '... impressive results from a handful of applications already optimized to take advantage of Intel's AES-NI capability' ". As an example it mentioned almost 7 times performance gain. My experiment on cryptographic-hardware (MX51 MCU) resulted with very poor performance. And I wanted to know other's experience with GMAC vs other MAC algorithms. $\endgroup$ – hab Jul 24 '15 at 9:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.