I have an idea for a peer-to-peer network that will require every connected peer to verify many symmetric signatures per second. In bitcoin, it's the same - every peer independently verifies signatures of every transaction. How many signatures, which sign some message (ECDSA or RSA or whatever is fast and secure) can middle-class computer verify per second (I would like to predict it to know how such network could scale)?
1 Answer
According to the SUPERCOP measurements, an Intel Xeon E3-1220v6 ("Kaby Lake", roughly comparable to a low end 7000 series i7) with 4 cores at 3GHz achieves 311689 cycles for one verification of an P-256 ECDSA signature and 51093 cycles for one verification of an RSA signature (presumably with $e=65537$). This means this machine can verify $4\times 3\cdot10^{9}/311689\approx 38500$ ECDSA signatures per second and $4\times 3\cdot10^{9}/51093\approx234866$ RSA signatures (lower exponents or using Rabin-Williams will be faster) per second.
Ed25519 instead of ECDSA-with-P256 will be about twice as fast. Using Rabin-Williams instead of RSA will be about 3.75x as fast (assuming the speedup from RSA-1024 to RW-1024 is the same for RSA-2048 and RW-2048, as there is no RW-2048 data).
It seems like a speed-up of about 2x can be gained for generic ECDSA using batch-verification. A similar (slightly better speedup?) can be achieved for Ed25519. Using RSA-3072 as opposed to RSA-2048 (to obtain a security level comparable to P-256) will bring a slow-down of 1.66, so 84746 cycles or about 141600 verifications per second.
-
1$\begingroup$ It is a little bit unfair: RSA-1024 is much weaker than 256-bit ECC, whose strength is more or less equivalent to RSA-3072. $\endgroup$ Jun 25, 2018 at 10:12
-
$\begingroup$ @ChangyuDong even RSA-3072 will be much faster for verifications than either ECDSA (although apparently not if batch-verification is used with Ed25519, but then RW will still be faster). $\endgroup$– SEJPMJun 25, 2018 at 11:41
-
$\begingroup$ Does that particular CPU have hardware for any of those algorithms? $\endgroup$– AwnJun 25, 2018 at 17:31
-
1$\begingroup$ @Awn as this is a standard Intel CPU the best it has is probably SIMD style instructions (ie SSE2 and friends) and wide-value multiplication and addition (64 x 64 -> 128 multiplication is available on x64 I think). Beyond that, no specific support for RSA or ECC crypto. $\endgroup$– SEJPMJun 25, 2018 at 17:33