Hacker News Reader

Comment by conradev | Hacker News Reader

  If the selling point is “faster,” you’d better wonder why that wasn’t the standard already in use.

Because “fast enough” is fast enough, unless it isn’t.

My desktop CPU has AES in hardware, so it’s fast enough to just run AES.

My phone’s ARM CPU doesn’t have AES in hardware, so it’s not fast enough. ChaCha20 is fast enough, though, and especially with the SIMD support on most ARM processors.

All this paper is saying is that ChaCha20 is not fast enough for some devices, and so folks had to put in intellectual effort to make a new thing that is.

But even further: everyone’s definition for “fast enough” is different. Cycles per byte matters more if you encrypt a lot of bytes.

View on HN

Only extremely old ARM CPUs (i.e. 32-bit CPUs from more than a decade ago) do not have AES hardware. All 64-bit ARM CPUs have it, like also at least the HW for SHA-1 and SHA-256. The more recent ARM CPUs have HW support for more cryptographic algorithms than the majority of the desktop CPUs.

"Lightweight" cryptography is not intended for something as powerful as a smartphone, but only for microcontrollers that are embedded in small appliances, e.g. sensors that transmit wirelessly the acquired data.

> Only extremely old ARM CPUs (i.e. 32-bit CPUs from more than a decade ago) do not have AES hardware.

I remember when Sun announced the UltraSPARC T2 in 2007 which had on-die hardware for (3)DES, AES, SHA, RSA, etc:

* https://en.wikipedia.org/wiki/UltraSPARC_T2

(It also had two 10 GigE modules right on the chip.)

I think I’m just getting old. I have a collection of KaiOS phones with Cortex-A7s but now they’re over a decade old :(

Newer ones have the Qualcomm 215, which, yes, is 64-bit 4x A53

From that perspective, LWC is only useful on old (existing?) microcontrollers: the Cortex-A320 that came out this year is 64-bit.

Hardware cycles take time, though, and it will be some time before everything is 64-bit!

Not all 64-bit ARM CPUs have AES support since it's part of the optional Crypto extension. The BCM2837 in the Raspberry Pi 4 is an ARMv8 CPU that lacks it.

You are right that the cryptographic instructions are optional and they have always been so in ARM CPUs, in order to enable the making of CPUs that can be embedded in products that will be exported even to destinations where cryptography is forbidden.

However the poster above was talking about smartphone Arm-based CPUs. I doubt that there has ever existed a 64-bit ARM-based CPU for smartphones that did not implement the cryptography extension. Even the CPUs having only Cortex-A53 cores that I am aware of, made by some Chinese companies for extremely cheap mobile phones, had this extension.

Reply on news.ycombinator.com