Yawning Angel <yawning@xxxxxxxxxxxxxxx> wrote: Hi Yawning, hi all, > Note, I'm not hating on Farfalle, I need to look at it more, and the > last time I gave serious thought to this question in a Tor context was > back around the time Prop 261 was being drafted. > > The answer to this from my point of view is "not slow to the point > where the network falls over", which I'll admit is extremely handwavy, > but truth be told, I have no idea what fraction of the relays are on > what micro architectures these days. > > Looking at the Farfalle and Kangaroo 12 papers, Kravette may be ok with > AVX2 assuming I'm extrapolating correctly. But, while it's probably > reasonable to assume that all the fast existing relays have AES-NI, I > do not know what fraction of those predate AVX2. You should end up with something like 13 cycles per byte for Farfalle with the Keccak permutation on Skylake. Would there be some way to test what effects this has on overall performance without harming any users? If this is *clearly* too slow, then it might be interesting to try the Farfalle construction with different permutations to see how far you can push performance. Cheers, Peter
Attachment:
signature.asc
Description: Digital signature
_______________________________________________ tor-dev mailing list tor-dev@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev