Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Signature algorithms with elliptic curves have smaller output sizes compared to RSA for the same level of security.
What about the processing time to generate a signature ?
I've seen figures giving the advantage to RSA. That seems curious.
Leaving aside the implementation aspects, what could justify (in terms of number of operations) the fact that ECDSA produces signatures faster than RSA (or vice versa) ?
ECDSA should in general create signatures faster than RSA for the same cryptographic strength if you just look at the mathematics. In the end the modular exponentiation is performed for smaller numbers. However, ECDSA depends on a random number generator, so ECDSA speeds may be slower if the random number generator blocks for any reason (and not using a good random number generator may compromise the ECDSA private key). The RSA PSS signature scheme also requires the use of random numbers, negating this performance advantage for RSA for this particular padding scheme.
[EDIT: well, the use of a random salt in RSA / PSS is at least the default option, and many implementations won't allow you to use an empty salt to make the scheme deterministic. RSA / PKCS#1 v1.5 padding for signature generation is fully deterministic and could be used instead; it doesn't come with a security proof like PSS does, but it hasn't been broken either]
RSA is generally much faster for signature verification as verification is performed using the public key. If a small exponents such as F4 (65537 or 10001 in hexadecimals) are used then RSA is generally faster than ECDSA, as only a minimum of modular multiplications is necessary.
The time required for RSA operations with the private key quickly rises for larger security strengths. ECDSA times also rise, but at a much slower rate.
ECC is much much faster than RSA for key generation. Finding large primes for RSA is a tough job even for current CPU's given a high enough key size.
Most RSA libraries have been around for a long time, are used much more often and are therefore more likely to have been optimized. So an RSA implementation may be faster than an equivalent ECDSA implementation (for small key sizes). ECC, in general, is a more complex algorithm to implement - but not necessarily to optimize, as CodesInChaos points out below.
Anyway, real world results will rely heavily on the speed of the implementations used. Note that the security level of such libraries also differs wildly, and selecting a crypto library just based on performance is not a good idea.
