<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">A new revision is online, which support SHA-512 and signatures. It’s still experimental, of course.</div><div class=""><br class=""></div><div class="">On my Macbook air (Haswell, TurboBoost @ 3.3GHz):</div><div class=""><br class=""></div><div class="">keygen: 48.7µs (20.5k/s; 161kcy)<br class="">ecdh: 169.3µs (5.9k/s; 559kcy)<br class="">sign: 51.8µs (19.3k/s; 171kcy)<br class="">verify: 187.9µs (5.3k/s; 621kcy)</div><div class=""><br></div><div class="">I agree that Karatsuba should be about right for speed comparisons, meaning (ratio of conjectured security bit strengths)^2.6.</div><div class=""><br class=""></div><div class="">Cheers,</div><div class="">— Mike</div><div class=""><br class=""></div><div><div class="">On Mar 1, 2014, at 10:47 PM, Trevor Perrin <<a href="mailto:trevp@trevp.net">trevp@trevp.net</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr" class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Fri, Feb 21, 2014 at 2:58 PM, Michael Hamburg <span dir="ltr" class=""><<a href="mailto:mike@shiftleft.org" target="_blank" class="">mike@shiftleft.org</a>></span> wrote:<br class="">
<blockquote style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex" class="gmail_quote"><div style="word-wrap:break-word" class=""><div class=""><br class=""></div><div class=""><a href="https://sourceforge.net/p/ed448goldilocks/code/ci/master/tree/" target="_blank" class="">https://sourceforge.net/p/ed448goldilocks/code/ci/master/tree/</a></div>
</div></blockquote><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div class="">Cool. It would be nice to see this on eBACS, but its performance looks good on my Macbook Air -</div><div class=""><br class=""></div><div class="">Scalar mults per second:</div><div class="">----</div>
<div class="">OpenSSL P-256 ~2800</div><div class="">OpenSSL P-384 ~1400</div><div class="">OpenSSL P-521 ~670</div><div class="">Curve25519-donna-c64 ~14300</div><div class="">Goldilocks-448 ~5900</div><div class="">(</div><div class=""> OpenSSL 1.0.2-beta1</div><div class=""> <a href="https://github.com/agl/curve25519-donna" class="">https://github.com/agl/curve25519-donna</a></div>
<div class=""> <a href="http://sourceforge.net/p/ed448goldilocks/" class="">http://sourceforge.net/p/ed448goldilocks/</a></div><div class=""> 2013 Macbook Air, 1.7 GHz Core i7</div><div class="">)</div><div class=""><br class=""></div><div class="">How do we compare the efficiency of different-size curves? Is it reasonable to assume performance scales as O(n) due to scalar size and O(n^1.6) due to Karatsuba, or O(n^2.6) overall, where n is the security level - i.e. the sqrt of the order of the base point?</div>
<div class=""><br class=""></div><div class="">For example, curve25519 has a security level of ~126 bits, so would we expect a comparably efficient curve of Goldilocks size (~223-bits security) to be ~4.4x slower = (223/126)^2.6 ?</div><div class=""><br class=""></div>
<div class=""><br class=""></div><div class="">Trevor</div></div><div class=""><br class=""></div></div></div></div>
</blockquote></div><br class=""></body></html>