search

paulmillr / noble-ciphers

Audited & minimal JS implementation of Salsa20, ChaCha and AES
https://paulmillr.com/noble
MIT License
212 stars 8 forks source link

Consider more algorithms: ascon, aegis, eme, rijndael-256 #12

Open paulmillr opened 1 year ago

paulmillr commented 1 year ago
  1. Ascon won NIST lightweight cryptography contest ^1
  2. Aegis is AES-based cipher present in linux, zig, libsodium ^2
  3. EME (ECB-Mix-ECB or, clearer, Encrypt-Mix-Encrypt) is a wide-block encryption mode developed by Halevi and Rogaway in 2003 eme. The reference link is also from an implementation in Go.
    • It's parallelizable. And it's used in rclone for the crypt backend. A personal reason is that I'm porting rclone to Web/Deno so having a professional implementation would be much better than my own.
    • Seems to be abandoned
  4. Rijndael-256. The confidentiality of AES-GCM is far below 128-bit security ^3. Confidentiality advantage for an attacker is < $\sigma^2/2^{129}$ where $\sigma$ is the number of encrypted 128-bit chunks. Rijndael to AES is what keccak is to SHA3: previous, unstandardized version. The idea is to support 256-bit blocks instead of 128-bit blocks of AES.

It's unclear if any of these algorithms are actually worth implementing in noble.

mirceanis commented 4 months ago

➕ 💯 for AESKW

that would allow me to greatly simplify the dependencies in several projects I maintain, where I have to use a very heavy isomorphic-webcrypto otherwise

paulmillr commented 3 months ago

@mirceanis AESKW is done.

alterstep commented 3 months ago

I would like AEGIS. There is a JavaScript implementation, but it's only AEGIS-128L and is not very good.

paulmillr commented 3 months ago

@alterstep any chance you'll be able to describe what are you using it for?

alterstep commented 3 months ago

@alterstep any chance you'll be able to describe what are you using it for?

Yes, I use libsodium on the server because AEGIS is very fast. On the client side, I could use libsodium-js, but it's very large, and I don't need its full functionality. Noble-ciphers would be perfect.

paulmillr commented 3 months ago

Yes, but why do you need something "very fast"? Why can't AES work for you?

alterstep commented 3 months ago

Yes, but why do you need something "very fast"? Why can't AES work for you?

256-bit nonces too.

paulmillr commented 3 months ago

Why AEGIS instead of XChacha20-poly1305?

alterstep commented 3 months ago

sodium AEGIS-256 is more than 5 times faster than XChaCha

paulmillr commented 3 months ago

Interesting, ok.

The question is, however, do you actually need this speed? Is the speed of algorithms a bottleneck in your application?

BigPanda97 commented 2 months ago

Ascon and AEGIS are both nice. And there is an Ascon-js version already available which could probably easily be implemented here.

paulmillr commented 2 months ago

Keep in mind it's not just "implementing" - it's also continuously supporting and perhaps having 3rd party audits of the code.

paulmillr commented 1 month ago

AEGIS has been implemented here: https://github.com/stknob/aegis-ts/tree/main