I wonder if Threefish would have been a better option. It's often overlooked.
Threefish has native support for disk encryption, since it has a tweak built right in. So rather than having to use a complex construction like Adiantum, you can just use a single primitive. Threefish is ARX, just like ChaCha. And its speed is within the ballpark (Wikipedia says 3.95cpb for ChaCha20; 6.1 cpb for Threefish).
Whether or not Adiantum as a construction is proved secure, its complexity will lead to increased risk of implementation failure.
In other words, you can choose to attempt to maintain secure implementions of ChaCha, Poly1305, and AES (which is notoriously difficult to get right without side channels). Or ... just implement Threefish (which is as simple to implement as ChaCha).
We considered it, of course, along with many other block ciphers. However, heavily optimized Threefish-256 is 22.6 cycles per byte on Cortex-A7 (by far the most common CPU this is needed on) which is over twice as slow as Adiantum. Threefish-512 and Threefish-1024 would be much slower still. We're already at the borderline of the performance needed to actually get all Android devices encrypted, so over 2x worse performance is a no-go.
Threefish also wasn't published as a standalone block cipher but rather was part of Skein, which lost the SHA-3 competition. Therefore it hasn't received as much cryptanalysis as ChaCha and AES, and probably won't get much more in the future.
Finally, note that unlike Adiantum, Threefish isn't a wide-block cipher, where flipping one bit in the sector scrambles all other bits. So comparing its complexity directly to Adiantum's is somewhat unfair. Other wide-block modes such as HCH and HCTR are also more complex than narrow-block modes.
I am not sure I care if Google has finally invented something for the public good. Because they are so fucking evil, I no longer trust them to the point that if I was dying of cancer, and they claimed to have invented the cure that I would trust them to cure me.
6 comments
[ 4.2 ms ] story [ 23.1 ms ] threadThreefish has native support for disk encryption, since it has a tweak built right in. So rather than having to use a complex construction like Adiantum, you can just use a single primitive. Threefish is ARX, just like ChaCha. And its speed is within the ballpark (Wikipedia says 3.95cpb for ChaCha20; 6.1 cpb for Threefish).
Whether or not Adiantum as a construction is proved secure, its complexity will lead to increased risk of implementation failure.
In other words, you can choose to attempt to maintain secure implementions of ChaCha, Poly1305, and AES (which is notoriously difficult to get right without side channels). Or ... just implement Threefish (which is as simple to implement as ChaCha).
We considered it, of course, along with many other block ciphers. However, heavily optimized Threefish-256 is 22.6 cycles per byte on Cortex-A7 (by far the most common CPU this is needed on) which is over twice as slow as Adiantum. Threefish-512 and Threefish-1024 would be much slower still. We're already at the borderline of the performance needed to actually get all Android devices encrypted, so over 2x worse performance is a no-go.
Threefish also wasn't published as a standalone block cipher but rather was part of Skein, which lost the SHA-3 competition. Therefore it hasn't received as much cryptanalysis as ChaCha and AES, and probably won't get much more in the future.
Finally, note that unlike Adiantum, Threefish isn't a wide-block cipher, where flipping one bit in the sector scrambles all other bits. So comparing its complexity directly to Adiantum's is somewhat unfair. Other wide-block modes such as HCH and HCTR are also more complex than narrow-block modes.
It seems like 2010's and early 2020's crypto will be based on Daniel Bernstein - ChaCha20, Poly1305, Curve25519