Re: [Cfrg] Benchmarks: 384 vs 389 vs Goldilocks vs ... on Haswell

"Paterson, Kenny" <> Sat, 03 January 2015 14:42 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id C9CFB1A8A20 for <>; Sat, 3 Jan 2015 06:42:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 0.798
X-Spam-Status: No, score=0.798 tagged_above=-999 required=5 tests=[BAYES_50=0.8, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id l4cuKW_M9rSF for <>; Sat, 3 Jan 2015 06:42:34 -0800 (PST)
Received: from ( [IPv6:2a01:111:f400:fe00::693]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id BD18F1A8A05 for <>; Sat, 3 Jan 2015 06:42:33 -0800 (PST)
Received: from ( by ( with Microsoft SMTP Server (TLS) id; Sat, 3 Jan 2015 14:40:22 +0000
Received: from ([]) by ([]) with mapi id 15.01.0049.002; Sat, 3 Jan 2015 14:40:22 +0000
From: "Paterson, Kenny" <>
To: Michael Hamburg <>
Thread-Topic: [Cfrg] Benchmarks: 384 vs 389 vs Goldilocks vs ... on Haswell
Thread-Index: AQHQI701KGpxET6GdkKNiBIGv4KjYZyqIa6AgAAmO4CABDb+gA==
Date: Sat, 03 Jan 2015 14:40:22 +0000
Message-ID: <>
References: <> <> <>
In-Reply-To: <>
Accept-Language: en-GB, en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/
x-originating-ip: []
authentication-results: spf=none (sender IP is );
x-dmarcaction: None
x-microsoft-antispam: BCL:0;PCL:0;RULEID:(3005003);SRVR:DBXPR03MB384;
x-exchange-antispam-report-test: UriScan:;
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:;SRVR:DBXPR03MB384;
x-forefront-prvs: 0445A82F82
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(199003)(189002)(51704005)(479174004)(97736003)(46102003)(101416001)(4396001)(20776003)(64706001)(92566001)(86362001)(66066001)(107046002)(561944003)(19580395003)(21056001)(105586002)(15975445007)(87936001)(31966008)(76176999)(83506001)(77156002)(120916001)(62966003)(106116001)(102836002)(2950100001)(50986999)(40100003)(19580405001)(77096005)(74482002)(106356001)(68736005)(36756003)(99396003)(54356999)(2900100001)(2656002)(122556002)(110136001); DIR:OUT; SFP:1101; SCL:1; SRVR:DBXPR03MB384;; FPR:; SPF:None; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en;
received-spf: None ( does not designate permitted sender hosts)
Content-Type: text/plain; charset="iso-8859-1"
Content-ID: <>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Jan 2015 14:40:22.0201 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2efd699a-1922-4e69-b601-108008d28a2e
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBXPR03MB384
Cc: "" <>
Subject: Re: [Cfrg] Benchmarks: 384 vs 389 vs Goldilocks vs ... on Haswell
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Crypto Forum Research Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 03 Jan 2015 14:42:37 -0000

Hi Mike,

On 31/12/2014 22:18, "Michael Hamburg" <> wrote:

>I¹m still a little bit perplexed about why you asked me to do this
>exercise.  The argument at the WF128 level seems to be about the existing
>trust and deployment of Curve25519 compared to a ³rigidly-generated²
>ed-256-mers.  At the WF192 and WF256 levels, there are no widely deployed
>³safe" curves, and it is between this same notion of ³rigidity² vs more
>³efficient² curves such as Curve41417, Ed448-Goldilocks and E-521.
>[Scarequoted because it¹s MSR's definition of rigidity, DJB and Tanja¹s
>safety criteria, and Trevor¹s and my efficiency metric.]

I asked because Watson had explicitly said that the 384-bit MGN prime
would be slower than others at WF192. I wanted to find out whether that
was really the case or not, with hard numbers:

>Is the introduction of another efficient curve near WF192 suggested to
>sway the rigidity camp¹s opinion about any of these proposals?
>Especially with people so sick of the endless arguments that they¹re
>cutting backroom deals?

The MGN proposal (draft-black) includes a specific curve at WF192, and I
simply wanted to understand its relative performance. If it was hopelessly
slow, then this would reasonably be interpreted as a negative point for
the specific curve and the MGN proposal in general (since it seems to be
an "take it or leave it" proposal, though I'd better let the proposers of
it speak to that detail). If the curve was competitive, then it could be
seen as a positive, and maybe some more people would become more amenable
to the proposal. As usual, I am trying to find a way forward here that
most people can live with.

Not sure if this answers your question or not...

>If you think data has a chance of moving things forward, I suggest that
>benchmarks of the Microsoft curves¹ (or at least primes¹) performance on
>ARM scalar/NEON would be more informative, because they¹d help determine
>whether the efficiency camp¹s curves are broadly more efficient and by
>how much.

I think hard data can only help, but I don't expect you to do the work