1
$\begingroup$

I am doing some research for which I intend to insert some (external) function in different cryptographic hash functions and I would like to analyse how the insertion of this extra code in the hash function affects its performance, especially its speed in hashing and any other performance measures.

I came across SUPERCOP and SMHasher (a test suite for non-cryptographic hash functions) but I have no idea whatsoever how to go about using either.

Anyone have any idea how any of these tools is used? Otherwise, does anyone know any other tool which I can use and how it is used?

Thanks in advance for your help.

Edit: My code is written in C under Linux.

Improve this question
$\endgroup$
3
  • $\begingroup$ I believe that questions about performance measurements might be better suited to Stack Overflow $\endgroup$
    – poncho
    Commented Apr 10, 2015 at 16:38
  • $\begingroup$ Maybe?! I just thought there are more cryptanalysts here, so higher chance of finding someone who has used a hash function performance measurement tool before... $\endgroup$
    – IT_guy
    Commented Apr 10, 2015 at 17:00
  • 1
    $\begingroup$ By performance, do you mean 'how long it takes to hash a block of N bytes'? If so, I don't see how measuring that is any different from measuring the performance of, say, a sorting algorithm (actually, it'd be easier, as most hash functions run in time independent of the data). On the other hand, if you're talking about (say) extracting the hash internal state, and looking for correlations (for example, if the correlations vanish after N rounds), that is obviously cryptographically relevant. However, I don't know of any automated tooling that would help with that. $\endgroup$
    – poncho
    Commented Apr 10, 2015 at 17:55

1 Answer 1

Reset to default
1
$\begingroup$

The performance can be configuration specific, so beware that any outcome is specific to a machine. Take care that you test on the right configuration(s).

The performance may also be specific to a certain input size. So test for specific amounts of data while keeping in mind that most hash methods operate on blocks (it doesn't make much sense to test 1 byte input and then 2 byte input, one block will be hashed regardless).

You don't need a lot more than a timer to measure such performance. First do x rounds of hashing just to make sure you are not left with startup flukes (hash code not loaded in cache of CPU yet). Note that this is specifically required when running on a VM. So for C / Linux it may not be that relevant - you can choose a smaller x.

Now let it run n rounds, divide by n. Choose a large number for n. That's about it.

If you want to reuse existing code then you can simply reuse the openssl speed commands. Just look up what happens in the code for openssl speed sha256 and implement another one next to it or extract the code.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Would have answered the same way on StackOverflow :) $\endgroup$
    – Maarten Bodewes ♦
    Commented Apr 12, 2015 at 10:18
  • $\begingroup$ Thanks a lot for the answer. However, I'm not completely sure what tool you were referring to in the main part of your answer... did you just mean I perform the hash and manually time how long it takes to get the result? I was thinking more in the lines of some sort of automated tool, like those I mentioned (SUPERCOP and SMHasher). As for the second part, thanks but I'm measuring the performance AFTER insertion of my own code! Thanks again for taking the time to answer. $\endgroup$
    – IT_guy
    Commented Apr 13, 2015 at 16:20
  • 1
    $\begingroup$ So? Insert your own code and make a separate openssl speed mysha256 CLI. Yes, in this case SHA-256 is embarrassingly linear, so you can just test using your own code and a timer. Only disadvantage seems to be that the reporting is missing (but I guess there are plenty tools to handle CSV files with timings). $\endgroup$
    – Maarten Bodewes ♦
    Commented Apr 13, 2015 at 17:11
  • $\begingroup$ Okay I see, thanks a lot for your help. True, I would have liked to have some formal reporting possibility but I'll definitely try that, for lack of a better, more "conventional" tool. $\endgroup$
    – IT_guy
    Commented Apr 14, 2015 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.