Re: [TLS] Twist security for brainpoolp256r1

[Ilari Liusvaara <[e-mail]>]

On Fri, Nov 14, 2014 at 10:46:13PM +0000, Oleg Gryb wrote:
> 
> > Openssl has a "speed" command that should be helpful. I'd expect a 
> > difference
> > higher than 30%.
> 
> 
> I had to change 'speed.c' in openssl to add barinpoolp256r1 (by default
> it simply not there). The difference for both ecdsa (signature) and ecdh
> (diffie-hellman-merkle key exchange) is less than 5%, so P-256 'optimization'
> in openssl is definitely overrated. I think, I'm good to go with Brainpool.

I did some quick benchmarking locally. The new code does ~2.4x(!) the number
of ECDH/ECDSA (all area accelerated by similar factor) ops per second compared
to the old.

(Intel i7 Ivy Bridge, so AVX but no AVX2).

> Doing 256 bit sign ecdsa's for 10s: 92012 256 bit ECDSA signs in 10.00s 
> Doing 256 bit verify ecdsa(nistp256)'s for 10s: 26294 256 bit ECDSA verify in 10.00s
> Doing 256 bit sign ecdsa's for 10s: 88745 256 bit ECDSA signs in 10.00s 
> Doing 256 bit verify ecdsa(brainpoolP256r1)'s for 10s: 24939 256 bit ECDSA verify in 10.00s
> 256 bit ecdsa (nistp256)   0.0001s   0.0004s   9201.2   2629.4
> 256 bit ecdsa (brainpoolP256r1)   0.0001s   0.0004s   8874.5   2493.9
> 
> Doing 256 bit  ecdh(nistp256)'s for 10s: 31820 256-bit ECDH ops in 10.00s
> Doing 256 bit  ecdh(brainpoolP256r1)'s for 10s: 29748 256-bit ECDH ops in 10.00s
> 256 bit ecdh (nistp256)   0.0003s   3182.0
> 256 bit ecdh (brainpoolP256r1)   0.0003s   2974.8

- What OpenSSL version that is based on?
- What build options?
- What CPU?

Those number don't pass my sanity checks if I assume new OpenSSL code:
- Difference between special prime and random prime is too small,
  hinting bad implementation of special prime.
- Extrapolation from numbers I got gives unreasonably low CPU speed.
 
If I estimate based on numbers I got (which is probably off for pre-AVX
or AVX2), I would estimate new p256 has about 2.5x the performance of
Brainpool.


-Ilari