What are the advantages of Poly1305-AES over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons of Poly1305-AES vs AES-GCM

  • $\begingroup$ Poly1305-AES is faster and more timing-attack resistant than AES-GCM? Do you have proof of that? Keep in mind the question isn't about chacha20-poly which is faster on hardware that don't have AES-NI $\endgroup$ – user12480 Jan 19 '17 at 18:32
  • $\begingroup$ Oops, I potato'ed there. But GHASH (the function underlying GCM) still has HW support on modern architectures which should make it faster than Poly1305 there. For the rest I'd have to look the numbers up first. $\endgroup$ – SEJPM Jan 19 '17 at 18:35

Poly1305-AES is a message authentication code. AES-GCM is an authenticated cipher. So it isn't a meaningful comparison.

But we could compare Poly1305-AES with AES-GMAC, which is a message authentication code. They're both Carter–Wegman–Shoup MACs built out of the block cipher AES and a universal hash family based on polynomial evaluation with differential probability bounded well below $2^{-100}$.

One essentially inconsequential difference is that Poly1305-AES uses part of its key directly for its universal hash while AES-GMAC passes its key through AES to derive a universal hash key.

The main difference between Poly1305-AES and AES-GMAC is the type of arithmetic used by the underlying universal hash family, Poly1305 or GHASH, respectively:

  • Poly1305 uses arithmetic in the prime field $\mathbb Z/(2^{130} - 5)\mathbb Z$ which is easy to implement fast in software without timing side channels.
  • GHASH uses arithmetic in the binary field $\operatorname{GF}(2^{128})$ which is hard to implement fast in software without timing side channels: if you don't have hardware support—or if a bug somewhere deep inside your leaning tower of software in a modern software stack has caused it to fail to take advantage of hardware support—then either your software will be slow, or your software will leak secrets through timing side channels.

Poly1305 is optimized for fast safe software implementations, whereas GHASH is a security risk unless you can guarantee you're using hardware support. Optimized implementations with hardware support are comparably fast, running at about 1 cpb.

Of course, the same criticism of GHASH applies to AES itself, which is why you should really use ChaCha20-Poly1305 instead of AES-GCM or anything built out of Poly1305-AES.

  • $\begingroup$ While theoretically feasible, are you aware of any actual timing attack on GHASH? $\endgroup$ – Ruggero May 11 '20 at 21:29
  • $\begingroup$ The Op asked for comparison between Poly1305, and GCM, they both provide authentication, so I don't see the point of comparing it to GMAC, if you need authenticated encryption then both are options, and a breakdown of things like performance and security, and the added data requirements would be nice for "pros and cons". $\endgroup$ – Daniel Hill Jan 17 at 3:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.