[Cryptography] Performance vs security

[John Kelsey]

There are specific algorithms where you have a pretty clear-cut security/performance tradeoff.  RSA and ECC both give you some choice of security level that has a big impact in terms of performance.  AES and SHA2 and eventually SHA3 offer you some secuirty level choices, but the difference in performance between them is relatively unimportant in most applications.  Probably the coolest thing about Keccak's capacity parameter is that it gives you an understandable performance/security tradeoff, but the difference in performance between c=256 and c=512 will probably not be noticable in 99% of applications.  

Then there are algorithms that give you higher performance at the cost of more fragility.  The example I can think of here is GCM, which gives you a pretty fast authenticated encryption mode, but which really loses security in a hurry if you reuse an IV.

It seems like these two kinds of security/performance tradeoffs belong in different categories, somehow.  

--John