I read that AES/GCM is a good choice for authenticated encryption because:

  1. AES has very strong heuristic security
  2. Encrypt-then-MAC leaks no information about the plaintext
  3. The CW-MAC in GCM can be hardware accelerated using the PCLMULQDQ instruction
  4. AES can be hardware accelerated

I also read that Salsa20 and Sosemanuk are 5-6 times faster than AES.

This leads me to ask why the eStream ciphers like Salsa20 and Sosemanuk are not deployed with the IV-CTR-mode in Encrypt-then-MAC configuration for Authenticated Encryption?

I am definitely a beginner, so I hope you'll excuse me if the question is naive.

  • 1
    $\begingroup$ Because somehow most people have settled for chacha-poly1305. $\endgroup$ – SEJPM Jun 12 '20 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.