Re: [Cfrg] Timing of libsodium, curve25519-donna, MSR ECCLib, and openssl-master

On 10/08/2014 07:05 PM, Michael Hamburg wrote:
> Whoa, they improved the performance by 50% since the paper and initial patch?!

on 09/03/2014 I reported 40% advantage of Curve25519-donna 
(17384.8/12348.9=1.40). Now it's 14% (17383.6/15168.1=1.146). That's on 
an AVX2 machine.

On my older i5 machine (not an AVX2 machine) the ratio is also improved. 
With the same instructions as quoted below:

was 14131.5/5231.7=2.7 (reported on 09/03/2013)
now: 14251.3/11105.2=1.27
(apparently due to Montgomery-style assembler code specialized for P-256 
prime)

This is even more interesting. These performance improvements 
apparently cover most of x86 CPUs in use today, clients and servers.

>
>> On Oct 8, 2014, at 6:01 PM, Andrey Jivsov <crypto@brainhub.org> wrote:
>>
>> Now that the P-256 enhancements are in the OpenSSL tree, let commands speak for themselves.
>>
>> Type in a Linux terminal on a Haswell machine (no HT, no SpeedStep/Turboboost) and observe:
>>
>> 1. P-256:
>>
>> $ git clone git://git.openssl.org/openssl.git A
>> $ cd A
>> $ ./config
>> $ make && apps/openssl speed ecdhp256
>>
>> 15078.1 op/s
>>
>> 2. X25519:
>>
>> $ git clone https://github.com/brainhub/curve25519-donna.git B
>> $ cd B
>> $ make speed-curve25519-donna-c64 && ./speed-curve25519-donna-c64
>>
>> 17289.4 op/s
>>
>> -----------------------------
>>
>> 17383.6 / 15168.1 = 14.6% faster
>>
>> The difference is about the cost of point decompression/coordinate conversion (e.g. Edwards coordinate conversion to Montgomery + point multiplication would have about the same performance as P-256 point multiplication).
>>
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> http://www.irtf.org/mailman/listinfo/cfrg