I have a question about the performance benefits (in terms of server-side CPU load) of ECC (Elliptic Curve cryptography) cipher suites in SSL/TLS.
It is a known fact that ECC is very good for performance, it offers a good "security / key length" ratio.
But ECC kan be used for 2 things in SSL/TLS sessions:
- ECC key establishment: ECDHE algorithm.
- ECC authentication: ECDSA algorithm with ECC server certificate.
So I am wondering: do you need the 'full' ECC package (ECDHE + ECDSA = ECC key establishment + ECC server certificate) to get a substantial performance gain with SSL, or does ECDHE (ECC key establishment) already provide the largest portion of the possible performance gain?
Or, to make this question less abstract, let's consider 3 SSL cipher suites:
a) Non-ECC cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (DHE-RSA-AES256-SHA256). Here ECC is not used at all.
b) Partial ECC cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ECDHE-RSA-AES256-SHA384). Here ECC is used for DH key establishment, while RSA is used for server authentication (RSA server certificate).
c) Full ECC cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (ECDHE-ECDSA-AES256-SHA384). Here ECC is used both for DH key establishment and for server authentication (ECC server certificate).
I assume that scenario C is better (performance wise) than scenario B, which in turn is better than scenario A. But: where exactly would scenario B be positioned?
If scenario A = 1% (bad performance: high server CPU load) and scenario C = 100% (good performance: low server CPU load), then how far can you get with scenario B: 10%, 50%, 90% ...?
I hope the question is clear and that someone knows the answer or can point me to some documentation about this subject.
Thanks in advance!
Bert