AES256-GCM on a non-AESNI platform

[niXman]

Hi,

from the documentation (https://doc.libsodium.org/secret-key_cryptography/aead/aes-256-gcm) it is not clear to me if AES256-GCM is available on a platform that does not support AESNI?

thanks!

[jedisct1]

Does the limitations part needs to be extended? It looks pretty clear that AESNI is required.

[niXman]

I'm very sorry, out of habit I went to the bottom of the page where Notes and Algorithm details are usually described.

it turns out that even if some ARM processors support AES instructions (https://en.wikipedia.org/wiki/AES_instruction_set#ARM_architecture) libsodium will still not support it?

[jedisct1]

Maybe it will! This is not very high priority, since the development version has AEGIS, which is more secure and way faster than AES-GCM, and already supports hardware acceleration on ARM.

[niXman]

since the development version has AEGIS

AEGIS?
is there a typo?
this is the first time I hear about this, and Google cannot find anything suitable on the topic of encryption...

means I can only test this using the master branch?
is this reflected in the documentation for the master branch? is the master branch documentation hosted somewhere? or do I have to read the documentation source for now?

thanks!

[jedisct1]

AEGIS?
is there a typo?

• Paper
• Draft

Yes, this is only available in the master branch until the next release.

The API is exactly the same as other AEADs, see:

• crypto_aead_aegis128l.h
• crypto_aead_aegis256.h

If you can't use master, and until the next release, standalone C/C++ implementations are available, such as this one in C and that one in C++.

AEGIS-128L can encrypt 170 Gb/s on a single server core. This is almost 3 times faster than the best AES256-GCM implementation.

[jedisct1]

Google also seems to return relevant links.

[jedisct1]

But to come back to the original topic of the discussion: libsodium already uses hardware accelerated AES on ARM CPUs, so AES-GCM is likely eventually support them as well.

[niXman]

unfortunately, last time I was switched to another task, but now I'm back! :)

after reading the Introduction from Paper, I could not figure out if AEGIS is capable of decrypting data encrypted with AES, and vice versa?
could you explain please?

[angt]

Hello,
AEGIS is a new AEAD construction that only uses the AES encryption round.
This has nothing to do with some form of compatibility with other AES-based methods.
Best regards.

[niXman]

@angt

AEGIS is a new AEAD construction that only uses the AES encryption round.

that is, AES is still used for encryption?

maybe I don't understand something, could you explain please?

[enkore]

AES is a block cipher. The AES round function is a part of AES (the other big part is the AES key schedule, which derives subkeys for each round from the main key). AEGIS uses the AES round function (not AES, the block cipher) to build an integrated AEAD (authenticated encryption) algorithm.

Why would you want to use the AES round function?
Couple reasons: It has been analyzed to death in the last twenty years - there is nothing wrong with it. And it is widely supported in hardware: Almost all mobile-laptop-desktop-server CPUs these days have dedicated AES instructions - specifically, instructions which compute the AES round function. So if you design an algorithm using the AES round function, you benefit from the existing hardware support immediately.

[jquick]

Any update on this? Most of our devs are moving to apple silicon and we just learned that our local dev env which uses AES-GCM is a no-go at the moment.

[philippealkan]

Same question for me, trying to upgrate to an new M1 Mac, as new Intel Macs will be discontinued this year, are we stuck with old hardware if we need good old AESGCM ?
Thanks,

[niXman]

yes, it would be great to add back AES-GCM.

[niXman]

@enkore

Why would you want to use the AES round function?

due to compatibility with existing services that still use AES-GCM.