Consider more algorithms: ascon, aegis, eme, rijndael-256

[paulmillr]

1. Ascon won NIST lightweight cryptography contest ¹
2. Aegis is AES-based cipher present in linux, zig, libsodium ²
   • https://crypto.stackexchange.com/a/106125, but unpopular
   • "We think NIST should standardize AEGIS" because it supports plaintexts up to 2EiB instead of AES-GCM 64GiB ³
   • Implemented using noble-ciphers in https://github.com/stknob/aegis-ts
3. EME (ECB-Mix-ECB or, clearer, Encrypt-Mix-Encrypt) is a wide-block encryption mode developed by Halevi and Rogaway in 2003 eme. The reference link is also from an implementation in Go.
   • It's parallelizable. And it's used in rclone for the crypt backend. A personal reason is that I'm porting rclone to Web/Deno so having a professional implementation would be much better than my own.
   • Seems to be abandoned
4. Rijndael-256. The confidentiality of AES-GCM is far below 128-bit security ³. Confidentiality advantage for an attacker is < $\sigma^2/2^{129}$ where $\sigma$ is the number of encrypted 128-bit chunks. Rijndael to AES is what keccak is to SHA3: previous, unstandardized version. The idea is to support 256-bit blocks instead of 128-bit blocks of AES.

It's unclear if any of these algorithms are actually worth implementing in noble.

Footnotes

1. https://csrc.nist.gov/News/2023/lightweight-cryptography-nist-selects-ascon ↩

2. https://doc.libsodium.org/secret-key_cryptography/aead/aegis-256 ↩

3. https://csrc.nist.gov/csrc/media/Presentations/2023/proposal-for-standardization-of-encryption-schemes/images-media/sess-4-mattsson-bcm-workshop-2023.pdf ↩ ↩²

[mirceanis]

➕ 💯 for AESKW

that would allow me to greatly simplify the dependencies in several projects I maintain, where I have to use a very heavy isomorphic-webcrypto otherwise

[paulmillr]

@mirceanis AESKW is done.

[alterstep]

I would like AEGIS. There is a JavaScript implementation, but it's only AEGIS-128L and is not very good.

[paulmillr]

@alterstep any chance you'll be able to describe what are you using it for?

[alterstep]

@alterstep any chance you'll be able to describe what are you using it for?

Yes, I use libsodium on the server because AEGIS is very fast. On the client side, I could use libsodium-js, but it's very large, and I don't need its full functionality. Noble-ciphers would be perfect.

[paulmillr]

Yes, but why do you need something "very fast"? Why can't AES work for you?

[alterstep]

Yes, but why do you need something "very fast"? Why can't AES work for you?

256-bit nonces too.

[paulmillr]

Why AEGIS instead of XChacha20-poly1305?

[alterstep]

sodium AEGIS-256 is more than 5 times faster than XChaCha

[paulmillr]

Interesting, ok.

The question is, however, do you actually need this speed? Is the speed of algorithms a bottleneck in your application?

[BigPanda97]

Ascon and AEGIS are both nice. And there is an Ascon-js version already available which could probably easily be implemented here.

[paulmillr]

Keep in mind it's not just "implementing" - it's also continuously supporting and perhaps having 3rd party audits of the code.

[paulmillr]

AEGIS has been implemented here: https://github.com/stknob/aegis-ts/tree/main