Re: [Suit] COSE_Sign vs. COSE_Mac

[Derek Atkins <[e-mail]>]

Hi,

David Brown <[e-mail]> writes:

> On Mon, Jun 04, 2018 at 05:59:41PM +0200, Koen Zandberg wrote:
>
>>My 2 cents for this scenario: the device I'm currently developing for
>>(samr21-xplained pro) takes around 8 seconds for ed25519 signature
>>verification (TweetNaCl implementation). An HMAC based verification
>>would be a lot faster here (saving me battery power). If you like I can
>>provide you some numbers on flash requirements for both HMAC and
>>public-key implementations.
>
> I think this more points out that there is a need for a better ed25519
> implementation for this kind of scenario.  On my mcu (120Mhz Cortex
> M7), TweetNaCl takes 1-2 seconds for a signature verification.  It is
> nice because it is only about 3kb of code.  The other implementation I
> have, from NaCl, takes on the order of 20-30ms for the same
> verification.  However, it is about 130Kb of code, which makes it
> unreasonable to use in many situations.

For the record, based on our experience on a Cortex M4 and Cortex R5, a
WalnutDSA signature verification would take you on the order of 5ms on
your M7 using only ~3kB of code.  (WalnutDSA is one of the NIST PQC
submissions).  The downside is that the signature is larger than ECC.

> What would be nice to have would be something in between.  A little
> bit larger code, but that runs faster than TweetNaCl.  There is a
> https://munacl.cryptojedi.org/faq.shtml microNaCl library that tries
> to do this.  However, it seems to be largely hand-written assembly,
> and targeted to very specific mcus.
>
> For this MCU, RSA code (using mbed TLS) is about 12Kb of code, and
> takes 400-500ms to do the signature verification.  Gut feeling is that
> Ed25519 could be implemented with similar code size and performance,
> or slightly better.
>
> I don't really have the depth of understanding needed to produce this
> implementation, however, but maybe someone does.

-derek

-- 
       Derek Atkins                 617-623-3745
       [e-mail]             www.ihtfp.com
       Computer and Internet Security Consultant