Hacker News Reader

Comment by ccktlmazeltov | Hacker News Reader

The first paragraph makes no sense that's true, but what follows is a good point. AES-GCM is much much faster than ChaCha20-Poly1305.

If:

1) your market is fragmented

2) many clients are cheap phones that don't support AES-NI

3) you can differentiate them so that you don't penalize better clients

Then yeah it makes sense to use Chacha20-Poly1305 for some of these clients.

But choosing Chacha20-Poly1305 over AES-GCM all the time doesn't, and I'm not sure why Wireguard does that (besides trying to be trendy).

View on HN

It's to make the design simpler. If you only use one crypto algorithm there's no cipher suite negotiation in the protocol (and thus no downgrade attacks). And while AES-GCM is faster with AES-NI, ChaCha20-Poly1305 is constructed to avoid timing side-channels (so software implementations are automatically much safer by default).

I would expect most clients to have hardware support for AES-GCM.

That's only true if most of your clients aren't mobile devices. That's why Google pushed for ChaCha20-Poly1305 standardisation and usage with TLS several years ago.

ChaCha20-Poly1305 outperforms AES on mobile devices where it matters most. The article espouses a desktop-centric view of the world that is completely obsolete.

It doesn't though, most mobile devices today have hardware support for AES.

Sure, that's a fine argument to make. But the article says "I expect AES to outperform ChaCha20 in every single scenario", even when the very next sentence talks about a scenario where that's not true.

> cheap phones that don't support AES-NI

Which are those mythical cheap phones? All the Qualcomm chips from the last N years have AES instructions, right?

Think India

4) you have customers with DSL or cable, with cheap routers, that run some 800 MHz MIPS or ARMv6 CPU. Dual core, if they are lucky. Think of the tp-links and netgears out there.

Compared to these routers, you average cheap cellphone is overpowered. 800 Mhz single or dual core is circa 2012 smartphone.

And this is on the gateway, not on the client, potentially serving several clients. Chacha20-Poly1305 absolutely murders AES there. AES won't even saturate 20MBit+ upload.

Reply on news.ycombinator.com