Re: [Cfrg] Benchmarks: 384 vs 389 vs Goldilocks vs ... on Haswell

["Paterson, Kenny" <[e-mail]>]

Hi Mike,

On 31/12/2014 22:18, "Michael Hamburg" <[e-mail]> wrote:

>I¹m still a little bit perplexed about why you asked me to do this
>exercise.  The argument at the WF128 level seems to be about the existing
>trust and deployment of Curve25519 compared to a ³rigidly-generated²
>ed-256-mers.  At the WF192 and WF256 levels, there are no widely deployed
>³safe" curves, and it is between this same notion of ³rigidity² vs more
>³efficient² curves such as Curve41417, Ed448-Goldilocks and E-521.
>[Scarequoted because it¹s MSR's definition of rigidity, DJB and Tanja¹s
>safety criteria, and Trevor¹s and my efficiency metric.]

I asked because Watson had explicitly said that the 384-bit MGN prime
would be slower than others at WF192. I wanted to find out whether that
was really the case or not, with hard numbers:

https://www.ietf.org/mail-archive/web/cfrg/current/msg05691.html


>Is the introduction of another efficient curve near WF192 suggested to
>sway the rigidity camp¹s opinion about any of these proposals?
>Especially with people so sick of the endless arguments that they¹re
>cutting backroom deals?

The MGN proposal (draft-black) includes a specific curve at WF192, and I
simply wanted to understand its relative performance. If it was hopelessly
slow, then this would reasonably be interpreted as a negative point for
the specific curve and the MGN proposal in general (since it seems to be
an "take it or leave it" proposal, though I'd better let the proposers of
it speak to that detail). If the curve was competitive, then it could be
seen as a positive, and maybe some more people would become more amenable
to the proposal. As usual, I am trying to find a way forward here that
most people can live with.

Not sure if this answers your question or not...

>
>If you think data has a chance of moving things forward, I suggest that
>benchmarks of the Microsoft curves¹ (or at least primes¹) performance on
>ARM scalar/NEON would be more informative, because they¹d help determine
>whether the efficiency camp¹s curves are broadly more efficient and by
>how much.

I think hard data can only help, but I don't expect you to do the work
here!

Cheers

Kenny