Re: [PATCH 1/2] crypto: x86 - remove aegis128 support

[Milan Broz <gmazyland@gmail.com>]

On 11/12/26 9:23 PM, Eric Biggers wrote:
> On Thu, Nov 12, 2026 at 05:44:17PM +0100, Ard Biesheuvel wrote:
>> From: Ard Biesheuvel <ardb@kernel.org>
>>
>> Even the people that are invested in Aegis appear to have lost interest
>> in aegis128: it did win the CAESAR competition but is no longer covered
>> by RFC 10032, which does list some other variants that competed as well.
>>
>> So let's delete it.
>>
>> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> 
> AEGIS-128 might be used by dm-crypt, e.g. if anyone passed
> '-c aegis128-random' to cryptsetup.  I added dm-devel and Milan Broz to
> Cc to comment on the feasibility of removing it.

AEGIS was introduced to kernel for dm-crypt to have real AEAD mode,
I do not think there is any other user.

At that time, there was nothing better.

Unfortunately, I am afraid it is used in some systems and removing it
completely could create issues for users. What you can do is to mark it
obsolete and expect it can be phased out later...

...

> But clearly AEGIS-128 is a mistake.  It has a hardcoded amount of
> parallelism that is much too small for current CPUs.  That was very
> clear when I looked into optimizing it with AVX-512: it just does not
> work, and it uses only a quarter of the CPU's resources.
> 
> That's resulted in AES-GCM now being much faster, as well as the people
> promoting AEGIS having abandoned AEGIS-128 and now advocating entirely
> for other variants like AEGIS-128X4 instead (despite that unfortunately
> still having a hardcoded amount of parallelism).
> 
> AEGIS-128 doesn't fare super well on the nonce front either, with it not
> being nonce-misuse-resistant, and its 128-bit nonce being only an
> incremental upgrade over AES-GCM's 96-bit nonce.  (Compare to
> XChaCha20Poly1305's or XAES-256-GCM's 192-bit nonce, or to AES-GCM-SIV
> which is nonce-misuse-resistant.)

AES-GCM is not good replacement due to that 96bit nonce.

I think other modes cannot be used in dm-crypt for AEAD mode, we will need
to check what is missing.

Milan