Add Chacha20-Poly1305, AES128-GCM and AES256-GCM support (#93) * Add Chacha20-Poly1305 authenticated encryption * Add general AEAD approach. * Add [email protected] algo using LibTomCrypt chacha and poly1305 routines. Chacha20-Poly1305 is generally faster than AES256 on CPU w/o dedicated AES instructions, having the same key size. Compiling in will add ~5,5kB to binary size on x86-64. function old new delta chacha_crypt - 1397 +1397 _poly1305_block - 608 +608 poly1305_done - 595 +595 dropbear_chachapoly_crypt - 457 +457 .rodata 26976 27392 +416 poly1305_process - 290 +290 poly1305_init - 221 +221 chacha_setup - 218 +218 encrypt_packet 1068 1270 +202 dropbear_chachapoly_getlength - 147 +147 decrypt_packet 756 897 +141 chacha_ivctr64 - 137 +137 read_packet 543 637 +94 dropbear_chachapoly_start - 94 +94 read_kex_algos 792 880 +88 chacha_keystream - 69 +69 dropbear_mode_chachapoly - 48 +48 sshciphers 280 320 +40 dropbear_mode_none 24 48 +24 dropbear_mode_ctr 24 48 +24 dropbear_mode_cbc 24 48 +24 dropbear_chachapoly_mac - 24 +24 dropbear_chachapoly - 24 +24 gen_new_keys 848 854 +6 ------------------------------------------------------------------------------ (add/remove: 14/0 grow/shrink: 10/0 up/down: 5388/0) Total: 5388 bytes * Add AES128-GCM and AES256-GCM authenticated encryption * Add general AES-GCM mode. * Add [email protected] and [email protected] algo using LibTomCrypt gcm routines. AES-GCM is combination of AES CTR mode and GHASH, slower than AES-CTR on CPU w/o dedicated AES/GHASH instructions therefore disabled by default. Compiling in will add ~6kB to binary size on x86-64. function old new delta gcm_process - 1060 +1060 .rodata 26976 27808 +832 gcm_gf_mult - 820 +820 gcm_add_aad - 660 +660 gcm_shift_table - 512 +512 gcm_done - 471 +471 gcm_add_iv - 384 +384 gcm_init - 347 +347 dropbear_gcm_crypt - 309 +309 encrypt_packet 1068 1270 +202 decrypt_packet 756 897 +141 gcm_reset - 118 +118 read_packet 543 637 +94 read_kex_algos 792 880 +88 sshciphers 280 360 +80 gcm_mult_h - 80 +80 dropbear_gcm_start - 62 +62 dropbear_mode_gcm - 48 +48 dropbear_mode_none 24 48 +24 dropbear_mode_ctr 24 48 +24 dropbear_mode_cbc 24 48 +24 dropbear_ghash - 24 +24 dropbear_gcm_getlength - 24 +24 gen_new_keys 848 854 +6 ------------------------------------------------------------------------------ (add/remove: 14/0 grow/shrink: 10/0 up/down: 6434/0) Total: 6434 bytes

Tech Note 0003
Minimizing Memory Usage
Tom St Denis

Introduction
------------

For the most part the library can get by with around 20KB of stack and about 32KB of heap even if you use the
public key functions.  If all you plan on using are the hashes and ciphers than only about 1KB of stack is required
and no heap.

To save space all of the symmetric key scheduled keys are stored in a union called "symmetric_key".  This means the 
size of a symmetric_key is the size of the largest scheduled key.  By removing the ciphers you don't use from
the build you can minimize the size of this structure.  For instance, by removing both Twofish and Blowfish the
size reduces to 768 bytes from the 4,256 bytes it would have been (on a 32-bit platform).  Or if you remove
Blowfish and use Twofish with TWOFISH_SMALL defined its still 768 bytes.  Even at its largest the structure is only 
4KB which is normally not a problem for any platform.  


Cipher Name | Size of scheduled key (bytes) |
------------+-------------------------------|
Twofish     | 4,256                         |
Blowfish    | 4,168                         |
3DES        | 768                           |
SAFER+      | 532                           |
Serpent     | 528                           |
Rijndael    | 516                           |
XTEA        | 256                           |
RC2         | 256                           |
DES         | 256                           |
SAFER [#]   | 217                           |
RC5         | 204                           |
Twofish [*] | 193                           |
RC6         | 176                           |
CAST5       | 132                           |
Noekeon     | 32                            |
Skipjack    | 10                            |
------------+-------------------------------/
Memory used per cipher on a 32-bit platform.

[*] For Twofish with TWOFISH_SMALL defined
[#] For all 64-bit SAFER ciphers.

Noekeon is a fairly fast cipher and uses very little memory.  Ideally in low-ram platforms all other ciphers should be
left undefined and Noekeon should remain.  While Noekeon is generally considered a secure block cipher (it is insecure
as a hash) CAST5 is perhaps a "runner-up" choice.  CAST5 has been around longer (it is also known as CAST-128) and is 
fairly fast as well.

You can easily accomplish this via the "config.pl" script. Simply answer "n" to all of the ciphers except the one you want
and then rebuild the library.  [or you can hand edit tomcrypt_custom.h]