Repository navigation
ChaCha20-Poly1305: compute the Poly1305 key block once - #56
Merged
Merged
Conversation
This was referenced Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
`tagOf` built the 32-byte one-time Poly1305 key as `Vector.ofFn fun i => (block key n 0)[i]!`, and the compiled code ran the ChaCha20 block for every byte: 32 blocks per seal or open. Binding the block once removes about 100 µs from every call. That fixed cost dominated small messages such as QUIC packets: huh over lean_quic seals and opens one ChaCha20-Poly1305 packet per datagram.
The "before" column comes from a probe in lean_quic, the "after" column from the new `chacha20-poly1305 encrypt 64B/1200B` benchmarks added here.
No proof unfolds `tagOf`'s body, so nothing else changes. `make test` passes, including 316/316 Wycheproof ChaCha20-Poly1305 vectors.
The rest of the per-packet cost is mostly Poly1305 over `Nat`, about 170 µs per KiB. That is for a separate PR.