Subject: Re: [Cfrg] Re: universal MACs

From: "D. J. Bernstein" <[email-masked]>
Date: 14 Jan 2005 06:58:36 -0000

I wrote, a couple of months ago:
> I've just posted http://cr.yp.to/papers.html#poly1305, introducing and
> analyzing Poly1305-AES, a 128-bit MAC.

As a followup: The Poly1305-AES paper will appear in the Fast Software
Encryption 2005 proceedings. Today I've posted http://cr.yp.to/mac.html
with C API details, a reference implementation, and some tests.

The main piece missing from the web page at this point is my optimized
implementation; stay tuned. In the meantime, I'll be happy to answer any
questions that people have about security, the API, protocol use, etc.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "D. J. Bernstein" <[email-masked]>
Date: 14 Jan 2005 06:58:36 -0000

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago
_______________________________________________
saag mailing list
[email-masked]
https://jis.mit.edu/mailman/listinfo/saag

---

From: "David A. McGrew" <[email-masked]>
Date: Mon, 17 Jan 2005 07:17:05 -0800

Dan,

thanks for posting the links to the new info.  It is interesting work.  
I encourage you to consider writing up an internet draft on this MAC 
and then moving it to an informational RFC if there is interest; my 
guess is that there will be plenty of interest.  There was discussion 
about generating an RFC for UMAC a while back, which shows the interest 
in this area (there was a UMAC draft, but never an RFC, nor were test 
vectors published IIRC).

For others on the list: anyone else interested in implementing the MAC? 
  It would be great to hear a 'second' on the test vectors, and it would 
be interesting to hear about implementation experience in other 
environments.  In particular, it will be useful to hear how the hash 
performs on platforms which lack fast floating-point multiplies, but 
which have a decent integer-based multiply (see Section 5 of "The 
Poly1305-AES message-authentication code").

David

---

From: Ken Raeburn <[email-masked]>
Date: Tue, 18 Jan 2005 22:18:36 -0500

On Jan 17, 2005, at 10:17, David A. McGrew wrote:
> For others on the list: anyone else interested in implementing the 
> MAC?  It would be great to hear a 'second' on the test vectors, and it 
> would be interesting to hear about implementation experience in other 

I got the same results from a Python implementation 
(www.mit.edu/~raeburn/poly1305aes.py) for the test cases in appendix A 
of the paper.

It's using the generic Python large-integer support, totally untuned 
for this specific application, and openssl's AES implementation via a 
small C module.  I doubt the performance numbers for this setup are 
going to be anything interesting. :-)

Ken