1
$\begingroup$

I have an idea for a peer-to-peer network that will require every connected peer to verify many symmetric signatures per second. In bitcoin, it's the same - every peer independently verifies signatures of every transaction. How many signatures, which sign some message (ECDSA or RSA or whatever is fast and secure) can middle-class computer verify per second (I would like to predict it to know how such network could scale)?

$\endgroup$
0

1 Answer 1

3
$\begingroup$

According to the SUPERCOP measurements, an Intel Xeon E3-1220v6 ("Kaby Lake", roughly comparable to a low end 7000 series i7) with 4 cores at 3GHz achieves 311689 cycles for one verification of an P-256 ECDSA signature and 51093 cycles for one verification of an RSA signature (presumably with $e=65537$). This means this machine can verify $4\times 3\cdot10^{9}/311689\approx 38500$ ECDSA signatures per second and $4\times 3\cdot10^{9}/51093\approx234866$ RSA signatures (lower exponents or using Rabin-Williams will be faster) per second.

Ed25519 instead of ECDSA-with-P256 will be about twice as fast. Using Rabin-Williams instead of RSA will be about 3.75x as fast (assuming the speedup from RSA-1024 to RW-1024 is the same for RSA-2048 and RW-2048, as there is no RW-2048 data).

It seems like a speed-up of about 2x can be gained for generic ECDSA using batch-verification. A similar (slightly better speedup?) can be achieved for Ed25519. Using RSA-3072 as opposed to RSA-2048 (to obtain a security level comparable to P-256) will bring a slow-down of 1.66, so 84746 cycles or about 141600 verifications per second.

$\endgroup$
4
  • 1
    $\begingroup$ It is a little bit unfair: RSA-1024 is much weaker than 256-bit ECC, whose strength is more or less equivalent to RSA-3072. $\endgroup$ Jun 25, 2018 at 10:12
  • $\begingroup$ @ChangyuDong even RSA-3072 will be much faster for verifications than either ECDSA (although apparently not if batch-verification is used with Ed25519, but then RW will still be faster). $\endgroup$
    – SEJPM
    Jun 25, 2018 at 11:41
  • $\begingroup$ Does that particular CPU have hardware for any of those algorithms? $\endgroup$
    – Awn
    Jun 25, 2018 at 17:31
  • 1
    $\begingroup$ @Awn as this is a standard Intel CPU the best it has is probably SIMD style instructions (ie SSE2 and friends) and wide-value multiplication and addition (64 x 64 -> 128 multiplication is available on x64 I think). Beyond that, no specific support for RSA or ECC crypto. $\endgroup$
    – SEJPM
    Jun 25, 2018 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.