It's some time since I posted benchmark figures. The speed dropped a bit
when I started to use the slow side-channel silent modinv, but I think
it's reasonable. For comparison, I just added openssl's ecdsa functions
to my benchmark program. These are the current figures for x86_64:
size modp redc modq add_jja dup_jj (us)
192 0.0248 0.0265 0.0450 0.6319 0.5151
224 0.0519 0.0467 0.0680 0.9136 0.7149
256 0.0834 0.0409 0.0802 0.8222 0.6617
384 0.0927 0.0000 0.0607 1.6663 1.2559
521 0.0347 0.0514 0.1289 1.5239 1.1670
name size sign / ms verify / ms
rsa 1024 6.3180 102.7909
rsa 2048 0.9562 29.2339
dsa 1024 11.1780 5.7492
ecdsa 192 14.9983 4.5612
ecdsa 224 8.0952 2.6880
ecdsa 256 7.7640 2.5785
ecdsa 384 2.9131 0.9155
ecdsa 521 1.7974 0.6594
ecdsa (openssl) 224 3.4939 3.0582
ecdsa (openssl) 384 1.4637 1.2603
ecdsa (openssl) 521 0.6962 0.5981
If we extract common functions for openssl (it seemed to lack secp192r1
and secp256r1), we get
ecdsa 224 8.0952 2.6880
ecdsa (openssl) 224 3.4939 3.0582
ecdsa 384 2.9131 0.9155
ecdsa (openssl) 384 1.4637 1.2603
ecdsa 521 1.7974 0.6594
ecdsa (openssl) 521 0.6962 0.5981
So it looks like for signing, the current code beats openssl by a factor
of two. While for verify, we're a little behind. And my code tries hard
to be side-channel silent (even for verify, where it doesn't matter).
I'm not sure if openssl tries to be side-channel silent.
Regards,
/Niels
--
Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.
_______________________________________________
nettle-bugs mailing list
[email protected]
http://lists.lysator.liu.se/mailman/listinfo/nettle-bugs
