Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What benefit is gained using a two-pass AE or AEAD scheme rather than a one-pass? Two-pass is roughly half the speed.

share|improve this question
up vote 4 down vote accepted

(Note for clarification: that EAX is two-pass does not mean that the input message must be buffered entirely before outputting the first encrypted byte; it means that EAX involves two invocations of the underlying block cipher per data block.)

Many one-pass AE schemes, such as OCB, are patented. Also, the one-pass schemes are also often "one-and-a-half-pass": they imply per input data block one block cipher operation, and one extra operation which is usually said to be "fast" but not necessarily that fast, depending on the context. For instance, on an embedded system with a 32-bit ARM CPU and low RAM, GCM tends to be slower than EAX, although GCM implies only one AES block encryption per 16 bytes of input: GCM also involves a multiplication in the finite field GF(2128), which can be made fast with the help of 64-bit registers or big precomputed tables, both of which lacking on many embedded systems.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.