What all block ciphers can achieve encryption speed similar/near to AES on general purpose computers with AES-NI enabled and disabled.
Camellia seems to be near to AES, and Twofish seems to be much slower than AES.
$\begingroup$
$\endgroup$
4
-
1$\begingroup$ You won't find any secure algorithm implemented in software that competes with AES-NI, so you may as well forget about that. $\endgroup$– Ella RoseCommented Feb 5, 2018 at 0:59
-
1$\begingroup$ ChaCha20 gets close, but it of course is not a block cipher. $\endgroup$– forestCommented Feb 5, 2018 at 4:02
-
$\begingroup$ any block cipher achieving speed near to camellia? $\endgroup$– cryptCommented Feb 5, 2018 at 9:35
-
$\begingroup$ Single DES possibly. However, using that has some - eh - consequences. I don't think there is any block cipher as fast as AES-NI, unless it itself has a hardware implementation. If you're looking for fast HW implementations then just try and find lightweight block ciphers and you'll find plenty fast ones. Lightweight is mainly pointing towards transistor count and such, but speedy is usually a concern as well. $\endgroup$– Maarten Bodewes ♦Commented Feb 5, 2018 at 14:53
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
4
Although one would like to think that AES-NI can speed up Camellia because the s-box structure is shared, there are differences because of the fact that Camellia is a Feistel-Network structure. AES-NI does not expose the intermediate layers of the circuits, so you'd have to use Camellia-NI instructions type architectures. I know my NTT phone has an IC that has Camellia instructions in it (or so says the manual)
One thing that you need to be mindful of when comparing ciphers is that people generally compare things to be favorable for their results. My Simon implementations were asynchronous and could complete a round in a "single cycle" due to the nature of the hardware. Regarding the speedup due to hardware, all ciphers can be optimized for a hardware implementation to make them "fast". You need a proper constraint set to compare them well, but in a synchronous system for the same clock speed, you need to do better than 14 instructions to beat AES-256.
-
$\begingroup$ This isn't correct. You can speed up Camellia using AES-NI. See this kernel commit. $\endgroup$– forestCommented Jan 30, 2019 at 7:16
-
$\begingroup$ @forest I stand corrected; however, there seems to be a change since I looked at AES-NI last as it does now seem to give intermediate sates. Things have changed since 2010. How would you like to address this question? $\endgroup$– b degnanCommented Jan 31, 2019 at 1:27
-
$\begingroup$ I'm pretty sure it handled intermediate states since the very beginning, at least since Intel released the extensions. It's always been the same 6 instructions. As for the question itself, it doesn't seem to be about AES-NI for Camellia but about ciphers with similar speed. $\endgroup$– forestCommented Jan 31, 2019 at 18:27
-
$\begingroup$ @forest Let me dig into this and edit things. $\endgroup$– b degnanCommented Jan 31, 2019 at 19:42