I was analysing the Chacha20 algorithm and the Poly1305 MAC generation from RFC 7539.

  • It seems that the Chacha20 is quite faster compared to AES on CPUs without hardware support like AES-NI.
  • But Poly1305 tag generation contains 16-byte random integer multiplication with another for each 16-byte block of ciphertext.

Can we achieve a relevant performance boost with this operation offload to a dedicated chip.?

  • $\begingroup$ Does your actual question is; I'm going to do research about constructing special hardware for Poly1305 to increase the speed up? Like this one Hardware implementation of the ChaCha20-Poly1305 AEAD construction $\endgroup$
    – kelalaka
    Oct 21, 2020 at 17:04
  • $\begingroup$ Why to a dedicated chip? The x86 64 bit instruction set also contains GMUL instructions directly in the instruction set to accelerate GMAC. Maybe you're better off using GCM instead if it comes to raw performance? $\endgroup$
    – Maarten Bodewes
    Oct 21, 2020 at 18:16
  • $\begingroup$ Thanks for the comments. I have been through an implementation for tls in which both chacha20 and poly1035 offloaded to specific hardware. I felt very bad as chacha20 is much faster on CPUs and thought of better performance could be brought up with limiting offload to poly1305. In my case CPUs needs to be freed incase of heavy crypto operations as it can handle more data path . $\endgroup$ Oct 23, 2020 at 2:36

1 Answer 1


Poly1305 is not as slow as it looks. The size of the prime field, $2^{130} - 5$, is purposely chosen so that multiplication in this field can be carried out very efficiently with basic arithmetic tricks. In fact, in real-world implementations, Poly1305 is perhaps much faster than the ChaCha20 part.

  • $\begingroup$ Welcome to Cryptography. $\LaTeX$/MathJax is enabled on our site. Note that the OP asking for improvement, not about its slowness or fastness. $\endgroup$
    – kelalaka
    Dec 21, 2021 at 10:12
  • $\begingroup$ Is it faster? Even taking into account that you need 4 computation of poly1305 to keep up with the 512-bit block size of chacha20 ? I honestly wonder. $\endgroup$
    – Ruggero
    Jan 16, 2023 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.