In What is the advantage of AEAD ciphers? Maarten Bodewes used the term 1.5 pass cipher in his answer. What is the difference between a 1.5 pass cipher and a 2 pass cipher? And why is Poly1305 a 1.5 pass cipher? Isn't the authentication tag in ChaCha20-Poly1305 calculated after the encryption in a separate step?
3
-
1$\begingroup$ Because the polynomial evaluation / update generally is cheap compared to a block cipher call, thus "0.5" calls. $\endgroup$– SEJPMApr 14, 2017 at 18:13
-
1$\begingroup$ Also see the following other three answers of his: 1 2 3 $\endgroup$– SEJPMApr 14, 2017 at 18:15
-
$\begingroup$ I've answered non-the-less as the other answers are for different questions and a full explanation (an edit of a previous answer) would harm the previous answers. $\endgroup$– Maarten Bodewes ♦Apr 15, 2017 at 20:02
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
A 2-pass authenticated cipher is a mode of operation that uses two full (block) cipher operations for each byte in the message. There is also a mode of operation, OCB mode, which uses a single pass to provide both message confidentiality and message integrity / authentication (it has been encumbered by IP-rights issues, so it isn't used that much).
A 1.5 authenticated cipher of course doesn't perform the encryption or authentication operation for every other byte. It simply uses an authentication algorithm that - when implemented right on the right hardware - is considered faster than the block cipher. Hence the 1.5 pass which should be read as one full pass of the block cipher + one pass - counted as 0.5 - for the faster authentication operation.
As an example GCM requires one block cipher operation and one 128-bit multiplication in the Galois field per each block (128 bit) of encrypted and authenticated data. 128-bit multiplication in the Galois field can be considerably faster than an AES block encrypt. Poly1305 has the same function as GMAC which specifies the Galois field multiplication within GCM.
Both GMAC and Poly1305 require post pre- and post processing. So for smaller messages the difference between a 1.5 and a 2 pass authenticated cipher may be less pronounced (depending as well on how much pre- and post processing the 2-pass cipher requires).
Please do not directly view the 0.5 as a performance indication. It depends on the algorithm and implementation what the speed differences are with 1-pass and 2-pass ciphers. it's just an indication that it should not be considered another full pass when it comes to the expected speed.
answered Apr 15, 2017 at 20:00