I need to encrypt some packets on a constrained hardware.

I was enthusiast about the NaCl suit, since Chacha/Salsa20 is a nice and fast symmetric cipher algorithm when no AES-NI instructions is available. But I discovered that poly1305 (the authentication layer) is based on AES!

Why? If I plan to use cryptobox it's because there is no AES; but if AES is available in hardware, may I prefer AES-GCM?

What is the logic behind this? Why poly1305-AES and not poly1305-Salsa20?

  • $\begingroup$ Are you sure that NaCl uses poly-1305 with AES and not with Salsa20? $\endgroup$
    – SEJPM
    Sep 13 '16 at 14:24
  • $\begingroup$ indeed i can't prove it, since the initial paper was about poly1305-AES, I guessed NaCl did use it... I may be wrong... (it may use xsalsa20 according to this : cr.yp.to/highspeed/naclcrypto-20090310.pdf) $\endgroup$
    – yota
    Sep 13 '16 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.