On Tue, Nov 19, 2019 at 04:44:11PM +0100, Jason A. Donenfeld wrote: > > > > So for future changes, could we please include performance numbers > > based on realistic workloads? > > Yea I share your concerns here. From preliminary results, I think the > Poly1305 code will be globally better, and I don't think we'll need an > abundance of discussion about it. > > The ChaCha case is more interesting. I'll submit this with lots of > packet-sized microbenchmarks, as well as on-the-wire WireGuard > testing. Eric - I'm guessing you don't care too much about Adamantium > performance on x86 where people are probably better off with AES-XTS, > right? Are there other specific real world cases we care about? IPsec > is another one, but those concerns, packet-size wise, are more or less > the same as for WireGuard. But anyway, we can cross this bridge when > we come to it. I'd like for Adiantum to continue to be accelerated on x86, but it doesn't have to squeeze out all performance possible on x86, given that hardware AES support is available there so most people will use that instead. So if e.g. the ChaCha implementation is still AVX2 accelerated, but it's primarily optimized for networking packets rather than disk encryption, that would probably be fine. - Eric
