5
$\begingroup$

NIST LWC finalists announced. My question is that how finalists are faster or slower than current golden lightweight AEAD standard -- ChaCha20-Poly1305.

Some benchmark among chacha20-poly1305 vs LWC finalists?

$\endgroup$
1

1 Answer 1

5
$\begingroup$

As for every benchmark, it all depends on the computing platform.

As mentionned in comment, you will find benchmarks at bench.cr.yp.to that include NIST LWC finalists and ChaCha-20. However, most of the architectures considered for those benchmarks are rather high-end computing platforms, and they do not necessarily reflect the landscape of constrained devices where lightweight cryptography takes all its sense.

If you are mostly interested in how the NIST LWC finalists compare with ChaCha20-Poly1305, you should take a look at the benchmark by Rhys Weatherley which focuses on embedded devices (8-bit AVR, ARM Cortex-M3 and ESP32 Arduino). As stated on the performance on 32-bit platforms webpage, all the benchmarking results are reported in comparison to ChaCha20-Poly1305:

The approach I take here is "ChaChaPoly Units". The library contains a reasonably efficient 32-bit non-vectorized implementation of the ChaChaPoly AEAD scheme from my Arduino cryptography library. This makes it a known quanitity to compare with other algorithms side by side.

If an algorithm is measured at 0.8 ChaChaPoly Units on a specific embedded microprocessor at a specific clock speed, then that means that it is slower than ChaChaPoly by a factor of 0.8 on that microprocessor. If the algorithm is instead measured at 2 ChaChaPoly Units, then it is twice as fast as ChaChaPoly on the same microprocessor. The higher the number of units, the better the algorithm.

As you can see, many of the NIST LWC finalists show better performance than ChaCha20-Poly on such platforms. Note that all implementations considered are running in constant-time to ensure a fair comparison.

Another point that matters for the NIST LWC final round is resistance against side-channel attacks. Because ChaCha20 is an ARX-based design, it is does not facilitate the integration of countermeasures against power side-channel attacks such as masking, as highlighted in previous works (e.g. in [1] and [2]). The benefits provided by the NIST LWC finalists over ChaCha20-Poly1305 will likely be of greater interest when considering power side-channels.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.