Why is 224 bit ecdsa faster than 192 bit ecdsa?

Question

I ran several benchmarks using openssl on 2 different computers and I got a surprising result.

for the Nist 192 bit curve the benchmark result is

>openssl speed ecdsap192
                              sign    verify    sign/s verify/s
 192 bit ecdsa (nistp192)   0.0001s   0.0003s  11980.6   3481.6

for the Nist 224 bit curve the benchmark result is

>openssl speed ecdsap224
                              sign    verify    sign/s verify/s
 224 bit ecdsa (nistp224)   0.0001s   0.0001s  13740.5   6948.8

So verifying a nistp224 ecdsa signature is twice faster than with nistp192.

I really expected nistp224 to be slower as it handles bigger numbers. Why isn't it so?

Answer 1

Both curves have similar form and primes close to powers of two ($2^{192}-2^{64}-1$ and $2^{224} - 2^{96} + 1$), so you wouldn't expect large differences in performance – all things equal, P-224 might be anywhere from 30% to 60% slower due to the computational scaling of curve operations.

However, in practice different implementations will have different performance and some curves' will be better optimized. In this case it looks like P-192 might only have a 32-bit portable implementation and P-224 an optimized 64-bit one:

Changes between 1.0.0h and 1.0.1 [14 Mar 2012]

[...] Add optional 64-bit optimized implementations of elliptic curves NIST-P224, NIST-P256, NIST-P521, with constant-time single point multiplication on typical inputs. [...]

_{(Note: I haven't actually checked if P-192 is unoptimized. You should do it with your version if you are interested.)}

As for why they would optimize P-224 better, it is the minimal acceptable size according to e.g. NIST recommendations. Doesn't make much sense to spend time optimizing something that's recommended not to be used.