Re: [Cfrg] Timing of libsodium, curve25519-donna, MSR ECCLib, and openssl-master

Andrey Jivsov <crypto@brainhub.org> Thu, 09 October 2014 01:01 UTC

Return-Path: <crypto@brainhub.org>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7D641A87ED for <cfrg@ietfa.amsl.com>; Wed, 8 Oct 2014 18:01:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 26yKWfuXW-Nn for <cfrg@ietfa.amsl.com>; Wed, 8 Oct 2014 18:01:28 -0700 (PDT)
Received: from resqmta-ch2-03v.sys.comcast.net (resqmta-ch2-03v.sys.comcast.net [IPv6:2001:558:fe21:29:69:252:207:35]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94B4E1A02D1 for <cfrg@irtf.org>; Wed, 8 Oct 2014 18:01:28 -0700 (PDT)
Received: from resomta-ch2-13v.sys.comcast.net ([69.252.207.109]) by resqmta-ch2-03v.sys.comcast.net with comcast id 0p1Q1p0032N9P4d01p1TsZ; Thu, 09 Oct 2014 01:01:27 +0000
Received: from [IPv6:::1] ([71.202.164.227]) by resomta-ch2-13v.sys.comcast.net with comcast id 0p1S1p0094uhcbK01p1SFR; Thu, 09 Oct 2014 01:01:27 +0000
Message-ID: <5435DE66.7080803@brainhub.org>
Date: Wed, 08 Oct 2014 18:01:26 -0700
From: Andrey Jivsov <crypto@brainhub.org>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.1.1
MIME-Version: 1.0
To: cfrg@irtf.org
References: <53F0010B.6080101@brainhub.org> <CD159876-F061-4EB8-B1DC-FAB8E4798E26@shiftleft.org> <53F108CF.4040704@brainhub.org> <53F18607.3000005@brainhub.org> <5406C23E.80205@brainhub.org> <5407C176.3000109@brainhub.org>
In-Reply-To: <5407C176.3000109@brainhub.org>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=comcast.net; s=q20140121; t=1412816487; bh=5F1GSoge9yBQiGXX/jjGvAP2xclmP90XHyP9l432xMI=; h=Received:Received:Message-ID:Date:From:MIME-Version:To:Subject: Content-Type; b=rzBlIN94HElSaCXkjqJcxeKH7n3A8LMDEfWezp2nwbuTDCJ1x8cg0y7Ne+b50Ci4j XMmuXs2a9JEn8UuYupJjQIL0LMO/o/lf58tmBOnY9An89MXfCEIUaKg2CLwIzqrypa o7Swytv8OSUWQgq2Uc4yqavLhef0A752ZeVCZiii20fzN783/LWUWhVzBSPsJKlD0r C2wcKgwgBkDhLlgMHE5wLAXxSIVcmPYnxWyznCG3enKMkD85mcdABonDxAF0c118Q9 KlLsKuKegvuBBoKowatkb83a00TCiwkPs9JH8GYJaBgvKAW9iBu0kjj3ITvWYRddeQ u7swBbpYdy25w==
Archived-At: http://mailarchive.ietf.org/arch/msg/cfrg/0CUqbQbp7ysK-QWxKUq_MLHOxxc
Subject: Re: [Cfrg] Timing of libsodium, curve25519-donna, MSR ECCLib, and openssl-master
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Oct 2014 01:01:31 -0000

Now that the P-256 enhancements are in the OpenSSL tree, let commands 
speak for themselves.

Type in a Linux terminal on a Haswell machine (no HT, no 
SpeedStep/Turboboost) and observe:

1. P-256:

$ git clone git://git.openssl.org/openssl.git A
$ cd A
$ ./config
$ make && apps/openssl speed ecdhp256

15078.1 op/s

2. X25519:

$ git clone https://github.com/brainhub/curve25519-donna.git B
$ cd B
$ make speed-curve25519-donna-c64 && ./speed-curve25519-donna-c64

17289.4 op/s

-----------------------------

17383.6 / 15168.1 = 14.6% faster

The difference is about the cost of point decompression/coordinate 
conversion (e.g. Edwards coordinate conversion to Montgomery + point 
multiplication would have about the same performance as P-256 point 
multiplication).