ChaCha12

[paulmillr]

@rweather the repository is cool and useful, thanks.

However, I don't understand one thing. Some performant algorithms have 2 cha-poly units judging from the tables.

But this did not include ChaCha8 or ChaCha12 (or salsa). It seems like they are even faster than the "lightweight cryptography" and had much more analysis?

Why was there a need for new algorithms?

[rweather]

I used ChaChaPoly as a baseline for comparison to get figures like "encrypting 128 bytes with algorithm X is 2.5 times faster than ChaChaPoly" while factoring out issues like clock speed and compiler optimisation options.

Because ChaCha8, ChaCha12, and Salsa weren't finalists to the NIST competition, I did not include them. I included AES and SHA256 because NIST asked for comparisons on those, but everything else is a finalist submission.

While ChaChaX is pretty fast, it isn't necessarily lightweight in memory consumption. The core state is 64 bytes, but another 64 bytes of space is needed for the keystream output. And that doesn't include the "Poly" bit. By comparison, ASCON's core permutation state is 40 bytes.