Symmetric Encryption Comparison

​

Overview

• Hardware availability (AES-NI vs pure software)
• Performance requirements
• Platform (server, mobile, embedded)
• Security requirements (side-channel resistance)
• Compliance needs (NIST, FIPS)

​

Quick Comparison

​

Detailed Comparison

​

Performance

​

Server (Intel/AMD with AES-NI)

• Encryption: 3-5 GB/s
• Decryption: 3-5 GB/s
• Key derivation: Fast (hardware-accelerated)

• Encryption: 1-2 GB/s
• Decryption: 1-2 GB/s
• Key derivation: Same as AES-GCM

​

Mobile (ARM with NEON)

• Encryption: 300-800 MB/s
• Decryption: 300-800 MB/s
• Battery: Higher consumption

• Encryption: 500 MB/s - 1 GB/s
• Decryption: 500 MB/s - 1 GB/s
• Battery: Lower consumption

​

Embedded (No Crypto Hardware)

• Encryption: 5-20 MB/s
• Decryption: 5-20 MB/s
• Side-channel: Vulnerable

• Encryption: 10-50 MB/s
• Decryption: 10-50 MB/s
• Side-channel: Resistant

​

Security Properties

​

Confidentiality

• AES-128: ~2¹²⁸ security (quantum: ~2⁶⁴)
• AES-256: ~2²⁵⁶ security (quantum: ~2¹²⁸)
• NIST approved for classified data

• 256-bit key: ~2²⁵⁶ security (quantum: ~2¹²⁸)
• Not NIST approved (but widely trusted)

​

Authentication

• 128-bit GMAC tag
• Based on finite field multiplication
• Forgery probability: ~2⁻¹²⁸

• 128-bit Poly1305 tag
• Based on polynomial evaluation
• Forgery probability: ~2⁻¹²⁸

​

Side-Channel Resistance

• Vulnerable to cache-timing attacks
• Table lookups leak information
• Requires constant-time implementation
• Mitigated by AES-NI (hardware)

• Resistant to cache-timing attacks
• No table lookups (bitwise operations only)
• Constant-time by design
• No hardware required

Cache-timing attack on software AES:
1. Attacker measures encryption time
2. Time variations reveal table lookup patterns
3. Patterns leak key information
4. After ~2^32 measurements, key recovered

ChaCha20-Poly1305 immune to this attack.

​

Implementation Complexity

​

AES-GCM

// AES-GCM requires:
// 1. AES block cipher (complex S-box, key schedule)
// 2. Counter mode (CTR)
// 3. Galois field multiplication (GF(2^128))
// 4. Authentication tag computation (GMAC)

// Total: ~500-1000 lines of complex code
// Difficult to implement correctly
// Easy to introduce vulnerabilities

• Cache-timing vulnerabilities
• Side-channel leaks in multiplication
• Incorrect tag verification
• Nonce handling errors

​

ChaCha20-Poly1305

// ChaCha20-Poly1305 requires:
// 1. ChaCha20 stream cipher (simple quarter-round)
// 2. Poly1305 MAC (polynomial evaluation)
// 3. Nonce/counter management

// Total: ~200-400 lines of simple code
// Easier to implement correctly
// Harder to introduce vulnerabilities

• No table lookups (simpler)
• No complex finite field math
• Easier to audit
• More resistant to implementation bugs

​

Standards and Compliance

​

AES-GCM

• NIST SP 800-38D
• FIPS 197 (AES)
• FIPS 140-2/140-3 approved

• Required for US government (FIPS)
• PCI DSS approved
• HIPAA approved
• Widely accepted worldwide

• TLS 1.2/1.3 (most common cipher)
• IPsec
• Disk encryption (BitLocker, FileVault)
• Widespread industry use

​

ChaCha20-Poly1305

• RFC 8439 (IETF)
• RFC 7539 (TLS)

• Not NIST/FIPS approved
• Not required by regulations
• Trusted by cryptographic community

• TLS 1.3 (mandatory cipher suite)
• WireGuard VPN
• Signal Protocol
• OpenSSH
• Growing adoption

​

Nonce Management

​

Both algorithms require unique nonces

// DANGEROUS for both algorithms
const key = generateKey();
const nonce = generateNonce();

const ct1 = encrypt(msg1, key, nonce); // OK
const ct2 = encrypt(msg2, key, nonce); // SECURITY FAILURE!

// Consequences:
// AES-GCM: Exposes keystream XOR, breaks authentication
// ChaCha20: Exposes keystream XOR, breaks authentication

• AES-GCM: 96 bits recommended (can use 1 to 2⁶⁴ bits)
• ChaCha20-Poly1305: 96 bits (fixed)

• Both: ~2³² encryptions per key (random nonces)
• Both: Unlimited with counter-based nonces

​

Use Case Recommendations

​

Server-Side Encryption (with AES-NI)

// Use AES-256-GCM on servers with AES-NI
import * as AesGcm from '@tevm/voltaire/AesGcm';

const key = await AesGcm.generateKey(256);
const nonce = AesGcm.generateNonce();
const ciphertext = await AesGcm.encrypt(plaintext, key, nonce);

• 2-3x faster with hardware acceleration
• NIST approved (compliance)
• Widespread industry adoption
• Well-tested in production

​

Mobile Apps

// Use ChaCha20-Poly1305 on mobile devices
import { chacha20poly1305 } from '@noble/ciphers/chacha';

const key = crypto.getRandomValues(Bytes32());
const nonce = crypto.getRandomValues(new Uint8Array(12));
const ciphertext = chacha20poly1305(key, nonce).encrypt(plaintext);

• Faster on ARM processors
• Lower battery consumption
• No hardware dependencies
• Better consistency across devices

​

Embedded Systems

• Fast without crypto hardware
• Constant-time (side-channel resistant)
• Smaller code size
• Simpler to implement correctly

​

VPN/Tunneling

• Fast on all platforms
• Simpler protocol design
• Better mobile performance
• Constant-time security

​

Database Encryption

• Hardware acceleration on servers
• Compliance requirements (FIPS)
• Industry standard
• Well-integrated with databases

​

Wallet Encryption

// Wallet encryption with AES-256-GCM
const salt = crypto.getRandomValues(Bytes16());
const key = await AesGcm.deriveKey(password, salt, 600000, 256);
const nonce = AesGcm.generateNonce();
const encryptedPrivateKey = await AesGcm.encrypt(privateKey, key, nonce);

// Better mobile performance
const key = await deriveKey(password); // PBKDF2 or Argon2
const nonce = crypto.getRandomValues(new Uint8Array(12));
const encrypted = chacha20poly1305(key, nonce).encrypt(privateKey);

​

File Encryption

• Faster throughput with hardware
• Better for bulk encryption

​

Web Applications

// WebCrypto API provides native AES-GCM
import * as AesGcm from '@tevm/voltaire/AesGcm';

// Hardware-accelerated in browsers
const key = await AesGcm.generateKey(256);
const encrypted = await AesGcm.encrypt(data, key, nonce);

• Native browser support (WebCrypto)
• Hardware acceleration available
• No dependencies required

​

Performance Benchmarks

​

Desktop (Intel Core i7 with AES-NI)

​

Mobile (ARM Cortex-A76)

​

Embedded (ARM Cortex-M4, no crypto HW)

​

Migration Guide

​

From AES-GCM to ChaCha20-Poly1305

// Before (AES-GCM)
import * as AesGcm from '@tevm/voltaire/AesGcm';

const key = await AesGcm.generateKey(256); // 32 bytes
const nonce = AesGcm.generateNonce();      // 12 bytes
const ct = await AesGcm.encrypt(pt, key, nonce);

// After (ChaCha20-Poly1305)
import { chacha20poly1305 } from '@noble/ciphers/chacha';

const key = crypto.getRandomValues(Bytes32());  // 32 bytes
const nonce = crypto.getRandomValues(new Uint8Array(12)); // 12 bytes
const ct = chacha20poly1305(key, nonce).encrypt(pt);

• Key size: Always 32 bytes (256-bit)
• Nonce size: Same (12 bytes)
• API: Similar pattern
• Output format: Same (ciphertext || tag)

​

From ChaCha20-Poly1305 to AES-GCM

// Before (ChaCha20-Poly1305)
import { chacha20poly1305 } from '@noble/ciphers/chacha';

const ct = chacha20poly1305(key, nonce).encrypt(pt);

// After (AES-GCM)
import * as AesGcm from '@tevm/voltaire/AesGcm';

const key = await AesGcm.importKey(keyBytes); // Convert key
const ct = await AesGcm.encrypt(pt, key, nonce);

• Key handling: Use CryptoKey (async)
• API: Async operations
• Performance: Potentially faster (with AES-NI)

​

Decision Matrix

• ✓ Running on server with AES-NI
• ✓ NIST/FIPS compliance required
• ✓ Industry standard needed
• ✓ Hardware acceleration available
• ✓ Integrating with existing systems

• ✓ Running on mobile/embedded
• ✓ No crypto hardware available
• ✓ Constant-time execution critical
• ✓ Simplicity/auditability important
• ✓ Better software performance needed

• ≈ Standard security requirements
• ≈ Both algorithms available
• ≈ Performance acceptable for both
• ≈ No specific compliance requirements

​

Hybrid Approach

// Platform-specific encryption
function encrypt(plaintext, key, nonce) {
  if (hasAESNI()) {
    return AesGcm.encrypt(plaintext, key, nonce);
  } else {
    return ChaCha20Poly1305.encrypt(plaintext, key, nonce);
  }
}

// Detect AES-NI support
function hasAESNI() {
  // Server: Check CPU flags
  // Browser: Test performance
  // Mobile: Assume ChaCha20 better
  return platform === 'server' && cpuHasAESNI;
}

​

Summary

• AES-GCM: Server, compliance, hardware available
• ChaCha20-Poly1305: Mobile, embedded, software-only

​

References

• AES-GCM Specification (NIST SP 800-38D)
• ChaCha20-Poly1305 Specification (RFC 8439)
• TLS 1.3 Cipher Suites (RFC 8446)
• WireGuard Protocol
• Real-World Crypto Performance