The web pages of BearSSL have the following performance numbers:

  • Poly1305 1730.92 MB/s, amd64, ctmulq
  • AES-128 CTR 92.38 MB/s, amd64, ct64

It seems that constant-time Poly1305 is over an order of magnitude faster than AES-128 in the counter mode, without any special CPU instruction support in either.

My understanding is that Poly1305, however, is based on AES (source). Why can something based on AES be faster than AES by a so wide margin?


1 Answer 1


Poly1305 is not based on AES, it was used together with AES in Bernstein's first description http://cr.yp.to/mac/poly1305-20050329.pdf. For pseudocode of the Poly1305 algorithm see e.g. https://www.rfc-editor.org/rfc/rfc7539#section-2.5.1.

GHASH is the 'hash function' in AES/GCM.

So if Poly1305 is faster than GHASH on some hardware this is no contradiction. And note that the peek values on your linked site are comparable: Poly1305 1730.92MB/s, GHASH 1740.96 MB/s.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.