Egregoros

Signal feed

Timeline

Post

Remote status

Replies

7
That's the one.

Per my recollection, it's based on 16*16->32 multiplication on 53 bit doubles, which is kind of wasteful. IMO it should have been 26*26->52 multiplication, which can do 128 bits with 5 limbs. There were other implementations of Poly1305 which used 26 bit limbs too, but they were in int32 and doing classical 32*32->64 multiplication.