Hacker News Reader

There's AES-NI, on most modern x64 processors, which helps with some Vpn ciphers. But I think Wireguard uses Chacha20 after the key exchanges for most of the traffic, and AES-NI doesn't help with that.

The following protocols and primitives are used:

ChaCha20 for symmetric encryption, authenticated with Poly1305, using RFC7539's AEAD construction Curve25519 for ECDH BLAKE2s for hashing and keyed hashing, described in RFC7693 SipHash24 for hashtable keys HKDF for key derivation, as described in RFC5869

My understanding is that modern crypto is fast enough without hardware acceleration, so it's not strictly needed. There are hardware accelerations for AES, SHA algorithms which are slow without acceleration.

There are ChaCha20 SIMD implementations / optimizations for x86, ARM, MIPS and possibly others:

- https://patchwork.kernel.org/project/linux-crypto/cover/2018...

- https://patchwork.kernel.org/project/linux-crypto/patch/2018...

- https://patchwork.kernel.org/project/linux-crypto/patch/2019...

In wireguard case it uses Chacha20 with vector instructions, which is almost as performant as AES-NI (and in rare cases even faster).