# How do RSA and ECDSA differ in signing performance?

Signature algorithms with elliptic curves have smaller output sizes compared to RSA for the same level of security.

What about the processing time to generate a signature ?

I've seen figures giving the advantage to RSA. That seems curious.

Leaving aside the implementation aspects, what could justify (in terms of number of operations) the fact that ECDSA produces signatures faster than RSA (or vice versa) ?

-

ECDSA should in general create signatures faster than RSA for the same cryptographic strength if you just look at the mathematics. In the end the modular exponentiation is performed for smaller numbers. However, ECDSA depends on a random number generator, so ECDSA speeds may be slower if the random number generator blocks for any reason (and not using a good random number generator may compromise the ECDSA private key). The RSA PSS signature scheme also requires the use of random numbers, negating this performance advantage for RSA.

RSA is generally much faster for signature verification as verification is performed using the public key. If a small exponents such as F4 (65537 or 10001 in hexadecimals) are used then RSA is generally faster than ECDSA, as only a minimum of modular multiplications is necessary.

The time required for RSA operations with the private key quickly rises for larger security strengths. ECDSA times also rise, but at a much slower rate.

ECC is much much faster than RSA for key generation. Finding large primes for RSA is a tough job even for current CPU's given a high enough key size.

Most RSA libraries have been around for a long time, are used much more often and are therefore more likely to have been optimized. So an RSA implementation may be faster than an equivalent ECDSA implementation (for small key sizes). ECC, in general, is a more complex algorithm to implement (but not necessarily to optimize, as CodesInChaos points out below).

-
Concerning optimized implementations, ECC has one big advantage: A fixed modulus which usually has been chosen to allow efficient reductions. Certain academics like publishing papers about their world record speed ECC implementations, so ECC has seen quite a bit of optimization work targeting modern CPUs. ECC is more complex mathematically, but I think it's actually easier to write a fast ECC implementation compared to a fast RSA implementation. – CodesInChaos May 28 '14 at 11:46