Re: [tor-dev] PQ crypto updates

Yawning Angel yawning@schwanenlied.me wrote:

Hi Yawning, hi all,

Ultimately none of this matters because Prop. 261 is dead in the water. Assuming people want the new cell crypto to be both fragile and to resist tagging attacks, Farfalle may be a better choice, assuming there's a Keccak-p parameterization such that it gives adequate performance.

At what number of cycles/block on what architecture(s) would you call the performance "adequate"?

Cheers,

Peter