In the application I'm writing there is need for a huge amount of private data transfer on the order of eighty gigabytes, but there is no public data. I'm looking especially to gain bandwidth/performance benefit by not using an AE scheme that expects associated data.

This is what I'm looking for:

  • As little bandwidth overhead as possible (seriously; this will make a world of difference)
  • No padding
  • No associated data
  • Low complexity (least important)

Out of all the options, which mode could I best put to use here? With these criteria, am I necessarily I looking for one-pass or two-pass?

EDIT: For the perfect answer to this type of question, see this answer.

  • You may want to define "AE", I got no idea about what it could mean in the context of the question. – Bruno Rohée Jun 22 '11 at 11:40
  • Authenticated Encryption? I wondered for a while if it was AES missing its S – Bruno Rohée Jun 22 '11 at 11:46
  • Sorry, yes. Authenticated encryption. – jnm2 Jun 22 '11 at 11:51

In every AE scheme I know of, there is at most a fixed amount of space and time overhead to an 'empty' associated data (for instance a transmitted length field in the header). Others, like EAX, have zero space overhead for the associated data, because the MACs are combined (for EAX, time overhead will consist of 2 more block cipher encryptions).

I would say given you plan to process huge messages, you absolutely want a one-pass mode, though! A one-pass mode will allow you to stream the message from sink to source without having to buffer the entire thing in memory.

| improve this answer | |
  • 1
    Note that there is a possible confusion with the notion of "two pass". Some modes (e.g. EAX) are called "two pass" because they require two AES block encryptions for every block of input data (one block for actual data encryption, and one for MAC). But it is still streamble. CCM is in-between: it can be streamed, but the total length must be known in advance. – Thomas Pornin Jun 22 '11 at 18:20

I came across the beginning and the end of this question:

Basic comparison of Modes for Authenticated-Encryption (IAPM, XCBC, OCB, CCM, EAX, CWC, GCM, PCFB, CS)

This document was perfect for this question and many others, and I'd mark it as the answer if that didn't seem megalomaniacal. But it's exactly the type of information I was asking for and I hope it helps.

| improve this answer | |

I recommend EAX (or any other AEAD scheme of your choice, for that matter). It is very easy to use, and there is no noticeable bandwidth penalty.

I think you are over-obsessing on the bandwidth penalty. If you use large messages, the bandwidth penalty is negligible. This is true for every AEAD scheme I've ever seen.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.