Re: [Cfrg] Timing of libsodium, curve25519-donna, MSR ECCLib, and openssl-master

[Andrey Jivsov <[e-mail]>]

In my previous message I missed that the openssl has a (non-default) 
configuration option that enables special handling of NIST primes with 
64 bit code that relies on the existence of a 128 bit integer.

On the same non-AVX2 machine this increases performance from ~ 3K to 5K 
op/s. This configuration of openssl code uses the same features (C only, 
64/128 bit) as curve25519-donna. Here is the updated number for the 
openssl along with the previously reported one for curve25519-donna for 
fair comparison:

./speed-curve25519-donna-c64:
70 us, 14131.5 op/s	

[andrey@ivy openssl-master]$ apps/openssl speed ecdhp256
                               op      op/s
  256 bit ecdh (nistp256)   0.0002s   5231.7

14131.5/5231.7=2.7

Intel(R) Core(TM) i5-3550 CPU @ 3.30GHz
cpu MHz		: 3281.308
No SpeedStep, Turboboost


Counting F(p) multiplies and squares as equal, OpenSSL's implementation 
of the P-256 uses a bit more than 11M, while X25519 (Curve25519) uses 
9M. This leaves with the observation that the 2^s-C prime contributes 
about a factor of 2 to the performance advantage of 2^255-19 v.s. 2^256 
- 2^224 + 2^192 + 2^96 - 1 in F(p).