Re: [TLS] Safe ECC usage

[Manuel Pégourié-Gonnard <[e-mail]>]

On 01/10/2013 18:22, Johannes Merkle wrote:
>>> Other than certificate size and the speed of making those
>>> calculations?  Really, try "openssl speed rsa2048 ecdsap256" on any
>>> Linux or Mac machine.
>>
>> openssl 1.0.1c x86_64 tells me ecdsap256 is 10x faster than rsa2048
>> for signing and 10x slower than rsa2048 for verifying.
> 
> RSA is much faster for signing than for verifying, while for ECDSA the
> time for these operations are quite similar.
> 
> So lets assume, ECDSA singing or verifying takes 1/10 s, then RSA
> signing takes 1 s and verifying 1/100 sec. Makes 0.2 s for ECDSA based
> handshake (one signing and one verifying operation) and 1.01 s for
> RSA. That is a huge difference.
>
Let's do the math, using openssl speed's results (1.0.1e on x86_64 linux,
slightly edited for clarity):

                              sign    verify
rsa 2048 bits            0.001558s 0.000048s
256 bit ecdsa (nistp256)   0.0001s   0.0003s

Now assuming the peer's certificate is signed by an intermediate CA,
itself signed by a root CA, we have 1 sign, 1 verify for the KeyExchange
or CertificateVerify message, 2 verify-s (signature by CA + crl) for the
peer's certificate, same for the intermediate CA, a total of 1 sign + 5
verify-s:

rsa 2048 bits:  1.8 ms
ecdsa 256 bits: 1.6 ms

So the two are mostly equivalent (with the NIST curve, a brainpool curve
would probably be slower, and a modern curve such a Ed25519 faster). ECDSA has
an advantage as soon as the certificate chain is shorter, up to a factor 4 for a
0-length certificate chain.

(Also, this is assuming the same key size and type for all certificates.
Certainly the best case for overall handshake speed is when the end-entity
certificate uses ECDSA while CA certificates use RSA.)

However, in a context where servers need to handle more handshakes per
second than clients and most handshakes don't use client auth, ecdsa is
interesting since it transfers some load from the server to the client,
probably a good news for server operators.

Manuel.