Detailed HTTPS Mobile symmetric encryption Suite Excellent

In recent years, Google, Baidu, Facebook and other internet giants vigorously implement HTTPS, many large internet companies at home and abroad have also enabled full-site https. Google also launched a new encryption suite chacha20-poly1305 for mobile optimization.

Pat Cloud CDN has fully supported Google's launch of the mobile-optimized encryption Suite--chacha20-poly1305. On the cloud platform, all CDN users can enjoy the advantages of this algorithm plus decryption performance, Web page load time, battery life extension and so on.

Before that, Pat. The cloud has been continuously optimized for HTTPS performance and is committed to HTTPS for faster data transfer performance. and Pat the cloud. HTTPS optimization has supported the following features: Session ID multiplexing, OCSP stapling, HSTS, HTTP/2, False Start, these features greatly improved HTTPS access speed.

And Pat Cloud CDN is now supported by the Google chacha20-poly1305 encryption suite, then compared to other cryptographic suites, why chacha20-poly1305 have these advantages?

Comparison of symmetric encryption algorithms

The commonly used symmetric encryption algorithms are as follows:

AES-GCM is a commonly used packet encryption algorithm, but its disadvantage is that the computational amount is large, resulting in higher performance and power overhead. To address this issue, Intel has introduced a x86 instruction extension set called AES NI (Advanced Encryption Standard new instructions), which provides support for AES from the hardware. For devices that support AES NI directives, using AES-GCM is undoubtedly the best choice.

For devices that do not support AES NI on the mobile side, Google introduced a new streaming encryption algorithm chacha20-poly1305 in 2014. On the ARM platform, the performance of chacha20-poly1305 is 3-4 times that of AES-GCM.

chacha20-poly1305 Algorithm Introduction

Chacha20-poly1305 is a new streaming encryption algorithm specifically designed for mobile CPU optimization, with a 3 times-fold improvement in performance compared to a common algorithm, especially on ARM platforms where the CPU is a thin instruction set (arm V8 before the effect is more pronounced). Where CHACHA20 refers to symmetric encryption algorithm, Poly1305 refers to the identity authentication algorithm. By using this algorithm, the amount of data generated by encryption and decryption can be reduced to improve the user experience, reduce waiting time and save battery life.

Due to its streamlined algorithm, strong security and strong compatibility, Google is now committed to fully promote it on the mobile side.

Better encryption and decryption performance

The current popular cryptographic suite aes-gcm, on hardware devices that do not support the AES NI directive, can cause performance problems for most smartphones, tablets, and wearables, resulting in excessive decryption performance over a long period of time.

The data released by Google show that chacha20-poly1305 can improve the device plus decryption performance by more than 30%. At the same time on some mobile devices, the chacha20-poly1305 encryption speed is 3 times times more than AES. That is, when using chacha20-poly1305, older computers or mobile devices will spend less computational time on encryption and decryption. Reduced encryption and decryption time means faster page loading and fewer device battery consumption.

For mobile devices, on a PC with hardware AES support, using the AES-GCM algorithm is a good choice, so the Pat Cloud CDN platform intelligently chooses the AES-GCM or chacha20-poly1305 based on the cryptographic suite supported by the client. For the latest Intel processors, the Cloud CDN uses the standard AES-GCM algorithm, and the chacha20-poly1305 is preferred for devices that do not have hardware AES support.

A more secure combination of cryptographic algorithms

The chacha20-poly1305 cipher suite uses two algorithms, where CHACHA20 is the symmetric encryption algorithm, and Poly1305 refers to the identity authentication algorithm.

RFC documentation

As you can see from the RFC documentation, CHACHA20 provides 256-bit encryption strength, which is more than sufficient for the 128-bit encryption strength of the AES-GCM algorithm. In other words, using CHACHA20 as a symmetric encryption algorithm to secure HTTPS security is sufficient.

POLY1305, which provides authentication as an authentication algorithm, prevents an attacker from inserting spurious information into a secure data stream during the TLS handshake, and the Poly1305 algorithm provides about 100 bits of security encryption that is sufficient to prevent such attacks. During the TLS handshake, authentication is less important than encryption, because even if an attacker can add false messages to the data stream, the internal data information is not read if the key information is not cracked.

In summary, chacha20-poly1305, as a cryptographic combination, provides confidentiality, integrity, and authenticity to the data, bypassing all existing security vulnerabilities and attacks, and is an excellent set of cryptographic suite combinations.

Open chacha20_poly1305 Mode

Pat Cloud CDN has already supported chacha20_poly1305 by default, and this algorithm is preferred as a symmetric encryption algorithm for terminals that do not support Aes-ni.

At present, the cloud provides SSL certificate subscription, management, deployment and other functions. With the international top-level CA institutions, the certificate type is rich, the operation process is simple and convenient, providing users with one-stop HTTPS security solution. Free SSL certificate within 1 hours, the paid version of OV, EV SSL certificate within 3 days to complete the purchase issue, and a key to complete the SSL certificate deployment immediately turn on the full-site HTTPS service open.

Current HTTPS certificate as low as 75 percent, immediately open the full-site HTTPS encryption service

Recommended reading:

From HTTP to HTTPS to HSTS

HTTPS series of Dry Goods (a): HTTPS principle of explanation

Why is the non-full station upgrade HTTPS not?

Detailed HTTPS Mobile symmetric encryption Suite Excellent