Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
The web pages of BearSSL have the following performance numbers:
It seems that constant-time Poly1305 is over an order of magnitude faster than AES-128 in the counter mode, without any special CPU instruction support in either.
My understanding is that Poly1305, however, is based on AES (source). Why can something based on AES be faster than AES by a so wide margin?
Poly1305 is not based on AES, it was used together with AES in Bernstein's first description http://cr.yp.to/mac/poly1305-20050329.pdf. For pseudocode of the Poly1305 algorithm see e.g. https://www.rfc-editor.org/rfc/rfc7539#section-2.5.1.
GHASH is the 'hash function' in AES/GCM.
So if Poly1305 is faster than GHASH on some hardware this is no contradiction. And note that the peek values on your linked site are comparable: Poly1305 1730.92MB/s, GHASH 1740.96 MB/s.
