5
$\begingroup$

I want to choose an efficient signature scheme for implementation on a lightweight MCU. I was wondering how does the performance of ECDSA and BLS signature schemes compare in terms of signing time and signature size, etc.?

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ By eyeballing the math behind both solutions, I'd like to say ECDSA (or better EdDSA) would be faster than BLS; but BLS is shorter. It would be nice to see some fair benchmarks. BLS has the disadvantage that pairing costs are approximate to some number of exponentiations. I'd need to read up on pairings. $\endgroup$
    – cypherfox
    Commented Mar 10, 2018 at 16:48

2 Answers 2

Reset to default
2
$\begingroup$

In fact it depends on various factors:

  1. Which curves and which level of security is your target?
  2. Which algorithms do you most frequently use key generation, signing, or verification?
  3. Which microcontroller is your target?
  4. Which compiler do you use?

But generally, based on ECRYPT Benchmarking of Asymmetric Systems report on March 2007 performed on x86, 2400MHz, Intel Pentium 4 (page. 164-165):

Comparison of Signature Schemes in Performance

(ecdonald is an implementation of ECDSA and compared values are in CPU cycles)

BLS signing algorithm is faster than ECDSA-256 but it is slower in key generation and verification.

Improve this answer
$\endgroup$
1
  • 2
    $\begingroup$ Hmmm, that ecrypt report is from 15 years ago - since then, we have found that pairing friendly curves didn't give the security we had, at the time, thought, and that to get that level of security, we needed to use somewhat larger curves. If that test was on, say, BN-256, we now know that's an apples-to-oranges comparison (security-wise) $\endgroup$
    – poncho
    Commented May 3, 2022 at 13:36
1
$\begingroup$

Found this article that seems to answer your question: https://www.dash.org/blog/bls-is-it-really-that-slow/

Improve this answer
$\endgroup$
1
  • $\begingroup$ Welcome to crypto-SE, and thanks for finding and sharing that interesting link. However link-only answers are at least discouraged, see “Provide context for links” in how-to-answer. $\endgroup$
    – fgrieu ♦
    Commented May 3, 2022 at 10:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.