On Thu, Jan 24, 2013 at 8:38 AM, Niels Möller <[email protected]> wrote:

>> Not for TLS. In TLS ECDHE is the primary application of elliptic
>> curves. [...] Typically one uses ECDHE with RSA keys in TLS.
> I see. What's the motivation, saving cycles in the key exchange, or
> smaller messages, or higher security, or something else?

If perfect forward secrecy is required then DHE is pretty inefficient
on security levels of 96 bits or more. ECDHE provides a fast
equivalent.

> On matrix (Intel i5, 3.4 GHz):
>  name size  sign / ms verify / ms
>   rsa 1024     6.3145   104.0742
>   rsa 2048     0.9555    29.4275
>   dsa 1024    11.1746     5.7460
> ecdsa  192     2.1167     1.5355
> ecdsa  224     1.2371     1.0234
> ecdsa  256     1.3845     1.0182
> ecdsa  384     0.6415     0.4751
> ecdsa  521     0.2515     0.2037

I usually use the table of ECRYPT II, to compare equivalent security levels.
http://www.keylength.com/en/3/
Otherwise the comparison may be unfair to ECDSA. RSA-1024 is used much
even today but it is roughly equivalent to an ECDSA key of 144 bits.

> For signing, plain DSA is currently fastest (I'd like to also include
> "DSA2", with 2048 bit p and 256 bit q, but my closest key generation
> programs didn't support that).

certtool does that.

> I could set up a public repository for my work-in-progress code, if
> there's some interest.

Why not on the main repository as a branch?

regards,
Nikos
_______________________________________________
nettle-bugs mailing list
[email protected]
http://lists.lysator.liu.se/mailman/listinfo/nettle-bugs

Reply via email to