/* * Copyright (C) 2015 Southern Storm Software, Pty Ltd. * * Permission is hereby granted, free of charge, to any person obtaining a * copy of this software and associated documentation files (the "Software"), * to deal in the Software without restriction, including without limitation * the rights to use, copy, modify, merge, publish, distribute, sublicense, * and/or sell copies of the Software, and to permit persons to whom the * Software is furnished to do so, subject to the following conditions: * * The above copyright notice and this permission notice shall be included * in all copies or substantial portions of the Software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER * DEALINGS IN THE SOFTWARE. */ /** \file crypto.dox \page crypto Cryptographic Library \section crypto_algorithms Supported Algorithms \li Block ciphers: AES128, AES192, AES256, Speck \li Block cipher modes: CTR, CFB, CBC, OFB, GCM \li Stream ciphers: ChaCha \li Authenticated encryption with associated data (AEAD): ChaChaPoly, EAX, GCM \li Hash algorithms: SHA256, SHA512, SHA3_256, SHA3_512, BLAKE2s, BLAKE2b (regular and HMAC modes) \li Message authenticators: Poly1305, GHASH, OMAC \li Public key algorithms: Curve25519, Ed25519 \li Random number generation: \link RNGClass RNG\endlink, TransistorNoiseSource, RingOscillatorNoiseSource All cryptographic algorithms have been optimized for 8-bit Arduino platforms like the Uno. Memory usage is also reduced, particularly for SHA256 and SHA512 which save 192 and 512 bytes respectively over traditional implementations. For all algorithms, static sbox tables and the like are placed into program memory to further reduce data memory usage. ChaCha with 20 rounds and 256-bit keys is the recommended symmetric encryption algorithm because it is twice as fast as AES128, constant-time, and much more secure. AES128, AES192, and AES256 are provided for use in applications where compatibility with other systems is desirable. If code size is an issue for your application (for example on very low end Arduino variants), then Speck on AVR is less than half the code size of ChaCha, at the cost of more data memory for the state and longer key setup times. The SpeckTiny and SpeckSmall classes are even smaller at the cost of some performance when encrypting. BLAKE2s and BLAKE2b are variations on the ChaCha stream cipher, designed for hashing, with 256-bit and 512-bit hash outputs respectively. They are intended as high performance replacements for SHA256 and SHA512 for when speed is critical but exact bit-compatibility of hash values is not. \section crypto_other Examples and other topics \li \ref crypto_rng "Generating random numbers" \section crypto_performance Performance \subsection crypto_performance_avr Performance on AVR All figures are for the Arduino Uno running at 16 MHz. Figures for the Ardunino Mega 2560 running at 16 MHz are similar:
Encryption AlgorithmEncryption (per byte)Decryption (per byte)Key SetupState Size (bytes)
AES128 (ECB mode)33.28us63.18us160.00us181
AES192 (ECB mode)39.94us76.48us166.54us213
AES256 (ECB mode)46.61us89.78us227.97us245
ChaCha (20 rounds)14.87us14.88us43.74us132
ChaCha (12 rounds)10.38us10.38us43.74us132
ChaCha (8 rounds)8.13us8.14us43.74us132
Speck (128-bit key, ECB mode)10.72us11.09us287.02us275
Speck (192-bit key, ECB mode)11.03us11.42us298.21us275
Speck (256-bit key, ECB mode)11.35us11.74us309.66us275
SpeckSmall (128-bit key, ECB mode)35.25us36.46us207.66us67
SpeckSmall (192-bit key, ECB mode)36.56us37.56us220.55us67
SpeckSmall (256-bit key, ECB mode)37.87us38.67us233.32us67
SpeckTiny (128-bit key, ECB mode)35.25us 10.22us35
SpeckTiny (192-bit key, ECB mode)36.56us 13.62us35
SpeckTiny (256-bit key, ECB mode)37.87us 16.89us35
AEAD AlgorithmEncryption (per byte)Decryption (per byte)Key SetupState Size (bytes)
ChaChaPoly41.20us41.19us902.36us221
GCM<AES128>109.71us109.26us1265.69us284
GCM<AES192>116.38us115.92us1485.56us316
GCM<AES256>123.04us122.59us1760.28us348
GCM<Speck> (256-bit key)87.78us87.32us714.41us378
GCM<SpeckTiny> (256-bit key)114.30us113.84us1270.32us138
EAX<AES128>71.14us71.14us1311.97us268
EAX<AES256>97.80us97.80us1806.57us332
EAX<Speck> (256-bit key)27.27us27.26us760.74us362
EAX<SpeckTiny> (256-bit key)80.31us80.31us1316.60us122
Hash AlgorithmHashing (per byte)Finalization State Size (bytes)
SHA25643.85us2841.04us 107
SHA512122.82us15953.42us 211
SHA3_25660.69us8180.24us 205
SHA3_512113.88us8196.34us 205
BLAKE2s20.65us1335.25us 107
BLAKE2b65.22us8375.36us 211
Authentication AlgorithmHashing (per byte)FinalizationKey SetupState Size (bytes)
SHA256 (HMAC mode)43.85us8552.61us2836.49us107
BLAKE2s (HMAC mode)20.65us4055.56us1350.00us107
Poly130526.26us489.11us17.06us53
GHASH74.59us15.91us14.79us33
Public Key OperationTime (per operation)Comment
Curve25519::eval()3119msRaw curve evaluation
Curve25519::dh1()3121msFirst half of Diffie-Hellman key agreement
Curve25519::dh2()3120msSecond half of Diffie-Hellman key agreement
Ed25519::sign()5688msDigital signature generation
Ed25519::verify()9030msDigital signature verification
Ed25519::derivePublicKey()5642msDerive a public key from a private key
Where a cipher supports more than one key size (such as ChaCha), the values are typically almost identical for 128-bit and 256-bit keys so only the maximum is shown above. \subsection crypto_performance_arm Performance on ARM All figures are for the Arduino Due running at 84 MHz:
Encryption AlgorithmEncryption (per byte)Decryption (per byte)Key SetupState Size (bytes)
AES128 (ECB mode)5.71us10.41us34.73us188
AES192 (ECB mode)6.87us12.57us36.51us220
AES256 (ECB mode)8.04us14.7249.96us252
ChaCha (20 rounds)0.87us0.88us4.96us136
ChaCha (12 rounds)0.70us0.71us4.96us136
ChaCha (8 rounds)0.62us0.62us4.96us136
Speck (128-bit key, ECB mode)0.97us0.96us36.80us288
Speck (192-bit key, ECB mode)1.00us0.98us38.14us288
Speck (256-bit key, ECB mode)1.03us1.01us39.31us288
SpeckSmall (128-bit key, ECB mode)2.72us2.30us26.89us80
SpeckSmall (192-bit key, ECB mode)2.80us2.39us27.80us80
SpeckSmall (256-bit key, ECB mode)2.90us2.48us29.08us80
SpeckTiny (128-bit key, ECB mode)2.72us 1.47us48
SpeckTiny (192-bit key, ECB mode)2.81us 1.54us48
SpeckTiny (256-bit key, ECB mode)2.90us 1.83us48
AEAD AlgorithmEncryption (per byte)Decryption (per byte)Key SetupState Size (bytes)
ChaChaPoly1.71us1.71us45.08us240
GCM<AES128>10.90us10.90us248.83us312
GCM<AES192>12.30us12.31us296.83us344
GCM<AES256>13.66us13.67us350.25us376
GCM<Speck> (256-bit key)5.27us5.28us75.31us408
GCM<SpeckTiny> (256-bit key)7.06us7.07us94.20us168
EAX<AES128>12.33us12.33us234.91us280
EAX<AES256>16.99us16.99us322.92us344
EAX<Speck> (256-bit key)2.80us2.80us81.63us384
EAX<SpeckTiny> (256-bit key)6.69us6.69us110.91us144
Hash AlgorithmHashing (per byte)Finalization State Size (bytes)
SHA2561.15us76.60us 120
SHA5122.87us370.37us 224
SHA3_2565.64us735.29us 224
SHA3_51210.42us735.49us 224
BLAKE2s0.72us48.24us 120
BLAKE2b1.29us165.28us 224
Authentication AlgorithmHashing (per byte)FinalizationKey SetupState Size (bytes)
SHA256 (HMAC mode)1.15us238.98us80.44us120
BLAKE2s (HMAC mode)0.72us157.75us57.18us120
Poly13050.81us19.01us2.57us60
GHASH4.47us1.52us2.60us36
Public Key OperationTime (per operation)Comment
Curve25519::eval()103msRaw curve evaluation
Curve25519::dh1()103msFirst half of Diffie-Hellman key agreement
Curve25519::dh2()104msSecond half of Diffie-Hellman key agreement
Ed25519::sign()195msDigital signature generation
Ed25519::verify()306msDigital signature verification
Ed25519::derivePublicKey()194msDerive a public key from a private key
*/