The Cost of a Macaroon

Macaroons are authorization credentials which have high efficiency and expressiveness that rivals public-key-based mechanisms like Simple Public Key Infrastructure (SPKI) / Simple Distributed Security Infrastructure (SDSI). Macaroons are simple and easy to deploy similar to web cookies. Additionally, they offer secure delegation via their chained hashed message authentication code (HMAC) construction which provides a construct for decentralized delegation. These characteristics are motivating factors for the adoption of macaroons; however, the modern web environment has changed since the initial concept was demonstrated on a local server and since that time there has been a broad adoption of cloud services and an expansion of mobile and embedded devices with the trend of Internet of Things (IoT).The approach utilized by macaroons has a much lower processing overhead and lower latency compared to other authorization methods used in the cloud. Our work investigates factors relating to the overhead costs of macaroon primitives. We implement a macaroons library in Python and replicate the measurements taken by Birgisson et al. in 2014. Then we evaluate the overhead of macaroon primitives and validate the prior findings regarding the cost of authorization primitives on a comparable computing platform. We also run tests with different payload sizes to assess if the prior results continue to hold true using a variety of common payload sizes. Our results provided insight into the trade offs of how efficient and expressive macaroons can be. We additionally evaluate the differences for the cost of authorization primitives across a variety of platforms to assess macaroons relative to the use of modern computer processors and modern software libraries, including ARM architecture processors to evaluate their use with IoT devices. Our results indicate that hardware and software advances have decreased the cost of using macaroons and they are efficient enough to use in low-power embedded platforms.