The Software Performance of Authenticated Encryption Modes
Ted Krovetz and
We study the software performance of authenticated-encryption modes CCM, GCM, and OCB.
Across a variety of platforms, we find OCB to be substantially faster than either alternative. For
example, on an Intel i5 (“Clarkdale”) processor, good implementations of CCM, GCM, and OCB
encrypt at around 4.2 cpb, 3.7 cpb, and 1.5 cpb, while CTR mode requires about 1.3 cpb. Still
we find room for algorithmic improvements to OCB, showing how to trim one blockcipher call
(most of the time, assuming a counter-based nonce) and reduce latency. Our fidings contrast
with those of McGrew and Viega (2004), who claimed similar performance for GCM and OCB.
FSE 2011. Springer, 2011.
Full version available in pdf.