I plan to use GPG to encrypt a small file (32KB) for very many recipient public keys (few thousands).
I tested GPG with RSA and then ECDH public key encryptions. If RSA is very slow, with ECDH (nist 256 curve) I get (still bad -but) better results:
1K destinataries encrypt: 14sec 5K destinataries encrypt: 5m42sec
Now, my understanding was that all GPG does is to encrypt the file with a symmetric (session) key, and then encrypt the symmetric key with the public key of each recipient. Thinking that the ECDH is the bottleneck, I did an
openssl speed ecdh on the machine and got:
256 bit ecdh (nistp256) op=0.0001s op/s=18934.7
My question is what can cause such a bad performance for 5K recipients if ECDH seems to be so quick with openssl? Is there anything else that GPG does (besides the symmetric and asymmetric encryptions) that can explain the 5m42s time?