[curves] Implementation
Michael Hamburg
mike at shiftleft.org
Wed Mar 5 16:46:29 PST 2014
A new revision is online, which support SHA-512 and signatures. It’s still experimental, of course.
On my Macbook air (Haswell, TurboBoost @ 3.3GHz):
keygen: 48.7µs (20.5k/s; 161kcy)
ecdh: 169.3µs (5.9k/s; 559kcy)
sign: 51.8µs (19.3k/s; 171kcy)
verify: 187.9µs (5.3k/s; 621kcy)
I agree that Karatsuba should be about right for speed comparisons, meaning (ratio of conjectured security bit strengths)^2.6.
Cheers,
— Mike
On Mar 1, 2014, at 10:47 PM, Trevor Perrin <trevp at trevp.net> wrote:
>
> On Fri, Feb 21, 2014 at 2:58 PM, Michael Hamburg <mike at shiftleft.org> wrote:
>
> https://sourceforge.net/p/ed448goldilocks/code/ci/master/tree/
>
>
> Cool. It would be nice to see this on eBACS, but its performance looks good on my Macbook Air -
>
> Scalar mults per second:
> ----
> OpenSSL P-256 ~2800
> OpenSSL P-384 ~1400
> OpenSSL P-521 ~670
> Curve25519-donna-c64 ~14300
> Goldilocks-448 ~5900
> (
> OpenSSL 1.0.2-beta1
> https://github.com/agl/curve25519-donna
> http://sourceforge.net/p/ed448goldilocks/
> 2013 Macbook Air, 1.7 GHz Core i7
> )
>
> How do we compare the efficiency of different-size curves? Is it reasonable to assume performance scales as O(n) due to scalar size and O(n^1.6) due to Karatsuba, or O(n^2.6) overall, where n is the security level - i.e. the sqrt of the order of the base point?
>
> For example, curve25519 has a security level of ~126 bits, so would we expect a comparably efficient curve of Goldilocks size (~223-bits security) to be ~4.4x slower = (223/126)^2.6 ?
>
>
> Trevor
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://moderncrypto.org/mail-archive/curves/attachments/20140305/865eebc8/attachment.html>
More information about the Curves
mailing list