headers
D. J. Bernstein | 3 Nov 2004 21:20
Picon

Poly1305-AES

I've posted a paper on the Poly1305-AES message-authentication code. See 
http://cr.yp.to/papers.html#poly1305. Software is coming soon.

The big advantage of Poly1305-AES over hash127 is that keys are stored
in just 32 bytes---no expansion required. In applications that deal with
a large number of keys simultaneously, hash127 pays a big speed penalty
for constantly missing the cache or constantly re-expanding keys;
Poly1305-AES avoids this problem.

For this reason, I recommend switching from hash127 (and UMAC and many
other functions) to Poly1305-AES.

Other API improvements: Poly1305-AES incorporates AES, as you might
guess from the name. Messages and authenticators are byte strings rather
than int32 strings. You provide a 32-byte key, a 16-byte nonce, and a
byte array containing the message; you receive a 16-byte authenticator;
that's it.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
Permalink | Reply |
headers
D. J. Bernstein | 14 Jan 2005 07:10
Picon

Re: Poly1305-AES

The Poly1305-AES MAC now has a C API showing how easy the function is to
use, a sample GMP-based implementation (in the public domain), various
tests, and a web page:

   http://cr.yp.to/mac.html

Next step is to release fast code (also in the public domain), including
speedups for the Athlon, the Pentium, the PowerPC, and the UltraSPARC.
At that point I'll officially declare the hash127 software to be dead.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
Permalink | Reply |
headers
D. J. Bernstein | 16 Feb 2005 06:46
Picon

Re: Poly1305-AES

There's now a mailing list for Poly1305-AES discussions. To subscribe,
send an empty message to poly1305-subscribe <at> list.cr.yp.to. I'm going to
shut the hash127 list down soon.

Public-domain Poly1305 software covering all common platforms is now
online. The only missing pieces are Athlon tweaks and a cross-platform
build script.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
Permalink | Reply |

Gmane