Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
As mentioned here the verification of a Ed25519 signature takes roughly 3 times as the time for the generation of a signature. Two questions on that:
1) Can I assume that this is a rule of thumb for this algorithm? I can imagine that the ratio of the times differ for different CPUs
2) How can I exactly see (using the algorithm) why verification takes (much) longer?
In elliptic curve cryptography, the main operation is point multiplication: given an integer $k$ and a point $P$, compute $kP$ ($P$ added to itself $k$ times).
If the point $P$ is known beforehand, the computation can be sped up by using precomputation tables.
EdDSA signing requires computing $rB$ where $B$ is a fixed point (the "base"), therefore can be sped up.
EdDSA verifying requires computing $sB - hA$, i.e one fixed point multiplication and one "random" point multiplication ($A$ comes from the signer's public key). If you assume the fixed point multiplication is twice as fast than random point multiplication, then the result is that verification is three times slower than signing.
But of course, it depends on the implementation. In a naive implementation that doesn't optimize the fixed point case, verification will be two times slower than signing. It also depends on the size of the precomputation tables used.
This is described abstractly in sections 3.3 and 3.4 of the RFC 8032 (which are slightly confusing due to the $2^c$ factors), and more concretely in 5.1.6, 5.1.7 for Ed25519 and 5.2.6, 5.2.7 for Ed448 (which explain that you can ignore the $2^c$ factors).
