As I understood AES GCM mode of operation gets good performance result because parallel execution of both encryption and hashing part.
Why AES and SHA-2 computation cannot be pipelined ?
1
-
1$\begingroup$ They can be, but SHA-2 is slower than GHASH. $\endgroup$– SEJPMJul 10, 2017 at 16:48
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
They can be computed in parallel.
But what would still make AES-GCM faster than AES-SHA2 is GCM itself.
GCM is a universal hash function: it can be very fast, especially on CPUs supporting carry-less multiplications. But it doesn't satisfy the same properties as a hash function such as SHA2. In particular, not encrypting its output would have catastrophic implications. It's fast because it is a simple and specialized function.
Even with Intel and ARM SHA extensions, I doubt it would be faster than GCM.
With AESNI and CLMUL, AES-GCM is about 0.65 cpb. SHA256 alone using Intel extension is about 3.8 cpb.
$\begingroup$
$\endgroup$
1
AES and GCM are both encryption algorithms meant to protect the contents of whatever the input is with a provided secret key from the user. AES can certainly be deciphered given the same key if the receiving party also has it.
SHA-2 is a hashing algorithm that is meant to serve a one-way purpose. This means it is not meant to be un-hashed. So Technically you would want to encrypt and hash in parallel which is not a very easy thing to do. The more rational approach (if you want to use both AES and SHA-2) would be to either encrypt using AES then hash, or hash, then encrypt.
-
1$\begingroup$ Extremely obviously, the question is about implementing Authenticated Encryption, comparing AES-GCM with AES-CTR-HMAC-SHA256 (with HMAC-SHA-256 replacing GHASH). AES-GCM using openssl on a CPU with AESNI and CLMUL is as fast as AES-CTR, i.e. you get the MAC for "free" time-wise because they are computed in parallel (interleaved). The question is whether computing SHA-256 in same manner in parallel with AEs-CTR is also possible. $\endgroup$– Z.T.Apr 30, 2019 at 21:31