Re: [Cfrg] Not the same thread -> was Re: Rerun: Elliptic Curves - preferred curves around 256bit work factor (ends on March 3rd)

Thanks, Paul.

On 3.6GHz Haswell with OpenSSL 1.0.1f:
RSA-2048: sign 1028us, verify 31us
Ed448: sign 51us, verify 163us, dh 148us
Ed480: sign 55us, verify 183us, dh 170us
E-521: sign 79us, verify 256us, dh 241us

On 1GHz Cortex A8 with OpenSSL 1.0.1f:
RSA-2048: sign 39.8ms, verify 1.2ms
Ed448: sign 0.7ms, verify 1.9ms, dh 1.9ms

On both CPUs, the elliptic curves are slower than RSA for verification, 
but much faster for signing.  The Haswell core is about 5-8x faster for 
RSA verify, and 20x slower for signing.

The A8 is more favorable to EC, probably because OpenSSL (or this build 
of it) doesn't use NEON for RSA.  It is only 60% faster for RSA 
verification, and 57x slower for signing.  But client devices don't sign 
very often.

-- Mike

On 02/25/2015 08:47 AM, Paul Lambert wrote:
>
> Could we please get some discipline on this list to not pollute 
> conversation threads – especially well formed threads asking for poll 
> with random questions, comments and rants.
>
> Paul
>
>
> From: Phillip Hallam-Baker <phill@hallambaker.com 
> <mailto:phill@hallambaker.com>>
> Date: Wednesday, February 25, 2015 at 8:22 AM
> To: Stephen Farrell <stephen.farrell@cs.tcd.ie 
> <mailto:stephen.farrell@cs.tcd.ie>>
> Cc: "cfrg@irtf.org <mailto:cfrg@irtf.org>" <cfrg@irtf.org 
> <mailto:cfrg@irtf.org>>
> Subject: Re: [Cfrg] Rerun: Elliptic Curves - preferred curves around 
> 256bit work factor (ends on March 3rd)
>
>     Do we have figures for performance of these versus RSA2048?
>
>     Yes, we get a reversal of the public/private speed advantage on
>     signature. And that in itself is a huge win on the server side
>
>     RSA signature verification takes 0.16 ms on a reasonably current
>     machine (signature is 6ms)
>
>     http://www.cryptopp.com/benchmarks.html
>
>     How much faster/slower one curve is over another matters much less
>     to me than whether the curve is faster or slower than what I am
>     already using. I am not going to be using P521 or P448 curves on a
>     constrained device, I will go for P255.
>
>     If we had figures comparing the curve candidates to RSA it would
>     probably be illuminating.
>
>
>
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg