A new revision is online, which support SHA-512 and signatures. It’s still experimental, of course.
On my Macbook air (Haswell, TurboBoost @ 3.3GHz): keygen: 48.7µs (20.5k/s; 161kcy) ecdh: 169.3µs (5.9k/s; 559kcy) sign: 51.8µs (19.3k/s; 171kcy) verify: 187.9µs (5.3k/s; 621kcy) I agree that Karatsuba should be about right for speed comparisons, meaning (ratio of conjectured security bit strengths)^2.6. Cheers, — Mike On Mar 1, 2014, at 10:47 PM, Trevor Perrin <[email protected]> wrote: > > On Fri, Feb 21, 2014 at 2:58 PM, Michael Hamburg <[email protected]> wrote: > > https://sourceforge.net/p/ed448goldilocks/code/ci/master/tree/ > > > Cool. It would be nice to see this on eBACS, but its performance looks good > on my Macbook Air - > > Scalar mults per second: > ---- > OpenSSL P-256 ~2800 > OpenSSL P-384 ~1400 > OpenSSL P-521 ~670 > Curve25519-donna-c64 ~14300 > Goldilocks-448 ~5900 > ( > OpenSSL 1.0.2-beta1 > https://github.com/agl/curve25519-donna > http://sourceforge.net/p/ed448goldilocks/ > 2013 Macbook Air, 1.7 GHz Core i7 > ) > > How do we compare the efficiency of different-size curves? Is it reasonable > to assume performance scales as O(n) due to scalar size and O(n^1.6) due to > Karatsuba, or O(n^2.6) overall, where n is the security level - i.e. the sqrt > of the order of the base point? > > For example, curve25519 has a security level of ~126 bits, so would we expect > a comparably efficient curve of Goldilocks size (~223-bits security) to be > ~4.4x slower = (223/126)^2.6 ? > > > Trevor >
_______________________________________________ Curves mailing list [email protected] https://moderncrypto.org/mailman/listinfo/curves
