Ilari Liusvaara writes: > I am not one of draft authors, but I tried to estimate the overhead > and ended up with in ballpark of 7%.
To clarify, you mean that the _cycle_ counts go up by 7%? My comparison was explicitly against the cost of "communicating the ciphertexts". That's a much larger cost. Quantitatively (see https://cr.yp.to/papers.html#pppqefs), sending a byte through the Internet costs roughly 2^(-40) dollars, while a cycle of CPU time costs roughly 2^(-51) dollars. Sending a kilobyte, for example, costs roughly 2^(-30) dollars. Hashing a kilobyte, at roughly 2^3 cycles/byte, costs roughly 2^(-38) dollars, which is hundreds of times smaller. As another example of the same type of comparison, spending 2^15 cycles on Kyber enc or dec costs roughly 2^(-36) dollars, which is still a very small percentage of roughly 2^(-30) dollars for communicating the Kyber ciphertext (never mind the scenarios where the key is sent too). This is very different from the situation with (e.g.) X25519, where the cost of CPU time is much more noticeable next to communication cost. ---D. J. Bernstein _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
