Re: draft-ietf-ipsec-ciph-aes-ctr-00.txt

[Arne Ansper <arne@ats.cyber.ee>]

> I don't think we can say that CTR mode is easier to implement in
> software than CBC mode. CTR mode probably isn't any faster than CBC,
> in general, in software, since software can't generally take
> advantage of the pipelining or parallelism.

yes it can.

for example, we have implemented IDEA and Rijandel using Pentium MMX
assembler instructions. 4 blocks are encrypted at the same time. using CBC
mode we can use this optimization only for encryption. using CTR mode we
can use this optimization for decryption too.

another idea: one can use the CTR mode to reduce the latency of the
encryption process. you can use the idle CPU cycles for producing the
encrypted stream of bytes. when the packet arrives you can just XOR it
with precomputed data. this way, you can use the spare memory to decrese
the latency of your device. you cannot do this with CBC mode.

when you use only CTR mode, you don't need decryption routines :) helps to
save couple of kilobytes of code memory.

arne