I was analysing the Chacha20 algorithm and the Poly1305 MAC generation from RFC 7539. It seems that the Chacha20 is quite faster compared to AES on CPUs without hardware support like AES-NI. But Poly1305 tag generation contains 16-byte random integer multiplication with another for each 16-byte block of ciphertext.

Can we achieve a relevant performance boost with this operation offload to a dedicated chip.?

  • $\begingroup$ Does your actual question is; I'm going to do research about constructing special hardware for Poly1305 to increase the speed up? Like this one Hardware implementation of the ChaCha20-Poly1305 AEAD construction $\endgroup$
    – kelalaka
    Oct 21 '20 at 17:04
  • $\begingroup$ Why to a dedicated chip? The x86 64 bit instruction set also contains GMUL instructions directly in the instruction set to accelerate GMAC. Maybe you're better off using GCM instead if it comes to raw performance? $\endgroup$
    – Maarten Bodewes
    Oct 21 '20 at 18:16
  • $\begingroup$ Thanks for the comments. I have been through an implementation for tls in which both chacha20 and poly1035 offloaded to specific hardware. I felt very bad as chacha20 is much faster on CPUs and thought of better performance could be brought up with limiting offload to poly1305. In my case CPUs needs to be freed incase of heavy crypto operations as it can handle more data path . $\endgroup$ Oct 23 '20 at 2:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.