It might sound like a weird comparison, but which one is faster, If I were to generate a CSPRNG every time or to sign(private encrypt) a data?

  • $\begingroup$ You may want to read this; please do not use "private encrypt" when it comes to signing data. $\endgroup$ – Maarten Bodewes Feb 26 '18 at 9:11
  • $\begingroup$ Thanks. Indeed i would not do a raw signature, What i wanted to mean is, just computing the signature and not the complete CMS signature. $\endgroup$ – Buzz LIghtyear Feb 26 '18 at 9:21

It costs a median of about 300 cycles on a modern x86 system to compute the ChaCha pseudorandom function, generating 64 bytes of output from a 32-byte reusable key and a 16-byte input.

It costs a median of about 50000 cycles on a modern x86 system to compute a 64-byte Ed25519 signature.

These numbers are from https://bench.cr.yp.to/. The fastest signature schemes reported there still cost over 1000 cycles.

But what on earth are you doing where there is any question of whether you should use a PRNG or a public-key signature? This is like going to a bicycle shop and asking whether you should buy a wheel or a handlebar. You should identify what your application's goals, threat model, and security needs are first before you try picking the fastest handlebar for your bicycle.

If I screw up my eyes and stand on my head and take your inquiry to mean that you want some properties of a pseudorandom function and some properties of a signature, maybe you want a VRF—but causing onlookers to have to stand on their heads is no way to build a secure system!

P.S. Signature is a fundamentally different concept from ‘encrypting with the private key’.


Symmetric algorithms are generally faster than the asymmetric ones you seem to want to use for signing - as you talk about a private key and don't mention a MAC. RSA private key operations are exceptionally slow if you look at the generic set of crypto primitives found in most libraries; only RSA key pair generation is much slower. CSPRNG's are generally build from symmetric primitives (the dual-ECC one is not used that much anymore).

Of course we should only compare primitives with on the same kind of platform and at the same security level.

In the end you want to test; it's the only way to be sure.

In practice the CSPRNG could still be slower if:

  • the CSPRNG includes the seeding;
  • retrieving the seed blocks;
  • the signature generation doesn't depend on a random value (RSA PKCS#1 v1.5 signatures are deterministic) or doesn't block itself.

If you go for signature generation you may want to consider ECDSA rather than RSA; it's much faster at the same security level (and probably any level on most platforms).

  • $\begingroup$ What am expecting here is to do a crypto challenge. There are two possibilities, one is the server generate a CSPRNG and encrypt with the client public key. The client can only decrypt it as he has the private key and he can send it back to the server for verification. $\endgroup$ – Buzz LIghtyear Feb 26 '18 at 9:27
  • $\begingroup$ Another option is server send an id, the client can sign it with the private key and send it to the server, so the server can be sure the client has the key $\endgroup$ – Buzz LIghtyear Feb 26 '18 at 9:28
  • $\begingroup$ Method 1, has the heavy crypto operation on the server side, while method 2 has it distributed to the client side. $\endgroup$ – Buzz LIghtyear Feb 26 '18 at 9:29
  • $\begingroup$ Not really, the private key operation is at the client side in both cases. But note that you may want to challenge the security of relying on the PRNG of the client. Many cryptosystems make sure they rely on randoms of both sides. $\endgroup$ – Maarten Bodewes Feb 26 '18 at 11:21
  • $\begingroup$ Private key operation, yes it’s in client side. But in addition to that the first method need to do a CSPRNG and a public key operation. Anyways, I agree that the random numbers should be relied on from both the server and client. Thanks you have provided me enough information. $\endgroup$ – Buzz LIghtyear Feb 26 '18 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.