Re: [Suit] COSE_Sign vs. COSE_Mac

[David Brown <[e-mail]>]

On Mon, Jun 04, 2018 at 05:59:41PM +0200, Koen Zandberg wrote:

>My 2 cents for this scenario: the device I'm currently developing for
>(samr21-xplained pro) takes around 8 seconds for ed25519 signature
>verification (TweetNaCl implementation). An HMAC based verification
>would be a lot faster here (saving me battery power). If you like I can
>provide you some numbers on flash requirements for both HMAC and
>public-key implementations.

I think this more points out that there is a need for a better ed25519
implementation for this kind of scenario.  On my mcu (120Mhz Cortex
M7), TweetNaCl takes 1-2 seconds for a signature verification.  It is
nice because it is only about 3kb of code.  The other implementation I
have, from NaCl, takes on the order of 20-30ms for the same
verification.  However, it is about 130Kb of code, which makes it
unreasonable to use in many situations.

What would be nice to have would be something in between.  A little
bit larger code, but that runs faster than TweetNaCl.  There is a
https://munacl.cryptojedi.org/faq.shtml microNaCl library that tries
to do this.  However, it seems to be largely hand-written assembly,
and targeted to very specific mcus.

For this MCU, RSA code (using mbed TLS) is about 12Kb of code, and
takes 400-500ms to do the signature verification.  Gut feeling is that
Ed25519 could be implemented with similar code size and performance,
or slightly better.

I don't really have the depth of understanding needed to produce this
implementation, however, but maybe someone does.

David