On Tue, Jul 07, 2026 at 06:08:10AM +0000, John Mattsson wrote: > > This seems like a great start! > > Instead of performing a full permutation for the relatively infrequent > key updates, it may be preferable to also use a lightweight "roll" > function to support inexpensive per-message ratcheting, similar to the > approach used by the Signal protocol.
This seems to run into problems with reodering/loss in DTLS and AES being slow to rekey (Chacha is much faster here). > The current draft still hands off record protection to a separate AEAD, > with the deck function merely deriving the traffic keys. In my view, > this leaves one of the most compelling opportunities unexplored. The > key schedule and record encryption could be integrated into a single > running duplex object. Unfortunately, Keccak does not seem to be very good for this. I recently experimented with using Keccak for record protection. Testing core loop (the dominant cost for long messages) of an impractical AEAD (8-way interleaved TurboKeccak in duplex mode) gave ~6GBps on AMD 7900X(@65W). -Ilari _______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
