Re: [saag] Re: [Cfrg] Re: universal MACs

["D. J. Bernstein" <djb at cr.yp.to>]

I wrote, a month ago:
> As a followup: The Poly1305-AES paper will appear in the Fast Software
> Encryption 2005 proceedings. Today I've posted http://cr.yp.to/mac.html
> with C API details, a reference implementation, and some tests.

As a further followup: I've posted my poly1305aes library, a very fast
public-domain implementation of Poly1305-AES, including tuning for the
Athlon, Pentium, PowerPC, and UltraSPARC. Sample timings:

   Poly1305(16-byte message): 693 Athlon cycles
   HMAC-MD5(16-byte message): openssl speed hmac says ~2700 Athlon cycles
   Poly1305(16-byte message): 800 UltraSPARC-III cycles
   HMAC-MD5(16-byte message): ~2200 UltraSPARC-III cycles
   Poly1305(1024-byte message): 3824 Athlon cycles
   HMAC-MD5(1024-byte message): ~12400 Athlon cycles
   Poly1305(1024-byte message): 5541 UltraSPARC-III cycles
   HMAC-MD5(1024-byte message): ~8600 UltraSPARC-III cycles

You can find the library at http://cr.yp.to/mac.html, along with
comprehensive benchmarks. If you're interested in further announcements,
join the poly1305 mailing list.

I should note that the library includes new AES code that achieves
state-of-the-art speed while resisting L1-cache timing attacks. The code
is limited to the case I care about in Poly1305-AES (no precomputation,
no decryption) but should still be of interest to other AES users. It
might even reduce my speed advantage over other secure CW MACs. :-)

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg