On 18 September 2018 at 13:36, Jason A. Donenfeld <Jason@xxxxxxxxx> wrote: > Hi Ard, > > On Tue, Sep 18, 2018 at 11:53:11AM -0700, Ard Biesheuvel wrote: >> On 17 September 2018 at 08:52, Jason A. Donenfeld <Jason@xxxxxxxxx> wrote: >> > Hi Ard, >> > >> >> Given that you show no interest whatsoever in gaining an understanding >> of the underlying requirements that we have to deal with in the crypto >> API, the only way to get my point across is by repeatedly stating it > > Sorry if I've come across that way, but I am certainly interested in > gaining such an understanding of said requirements. > Excellent. So you are probably aware that there is a big push in the industry these days towards high-performance accelerators on a coherent fabric, potentially with device side caches, and this is the main reason that the crypto API abstractions are the way they are today. So while standardizing on Chacha20Poly1305 in WireGuard [while still a policy decision in my view] seems reasonable to me, the decision to limit WireGuard to synchronous software implementations seems to me like something we may want to revisit in the future. What is your view on that? And is the ChaCha20/Poly1305 AEAD construction in WireGuard identical to the one in RFC 7539, i.e., could an accelerator built for the IPsec flavor of ChaCha20Poly1305 potentially be reused for WireGuard?
