Subject: Re: [Cfrg] Timing of libsodium, curve25519-donna, MSR ECCLib, and openssl-master

From: Andrey Jivsov <[email-masked]>
Date: Wed, 03 Sep 2014 00:24:46 -0700

In my previous message I missed that the openssl has a (non-default) 
configuration option that enables special handling of NIST primes with 
64 bit code that relies on the existence of a 128 bit integer.

On the same non-AVX2 machine this increases performance from ~ 3K to 5K 
op/s. This configuration of openssl code uses the same features (C only, 
64/128 bit) as curve25519-donna. Here is the updated number for the 
openssl along with the previously reported one for curve25519-donna for 
fair comparison:

./speed-curve25519-donna-c64:
70 us, 14131.5 op/s	

[andrey@ivy openssl-master]$ apps/openssl speed ecdhp256
                               op      op/s
  256 bit ecdh (nistp256)   0.0002s   5231.7

14131.5/5231.7=2.7

Intel(R) Core(TM) i5-3550 CPU @ 3.30GHz
cpu MHz		: 3281.308
No SpeedStep, Turboboost

Counting F(p) multiplies and squares as equal, OpenSSL's implementation 
of the P-256 uses a bit more than 11M, while X25519 (Curve25519) uses 
9M. This leaves with the observation that the 2^s-C prime contributes 
about a factor of 2 to the performance advantage of 2^255-19 v.s. 2^256 
- 2^224 + 2^192 + 2^96 - 1 in F(p).

---

From: Andrey Jivsov <[email-masked]>
Date: Wed, 03 Sep 2014 18:33:42 -0700

A recent contribution from Intel to openssl, not yet a part of openssl, 
implements NIST P-256 EC crypto with AVX2 instruction set.

This code on my Haswell CPU shows that X25519 is 40% faster than P-256. 
This is a data point to consider regarding how close two optimized 
implementations can be on the same CPU depending on their choice of the 
target instruction set.

[andrey@M93p curve25519-donna]$ ./speed-curve25519-donna-c64
66 us, 15148.2 op/s

v.s.

[andrey@M93p openssl-master]$ apps/openssl speed ecdhp256
                               op      op/s
  256 bit ecdh (nistp256)   0.0001s  10810.6

15148.2/10810.6 = 1.40

The above is with no hyperthreading, no speedstep
model name	: Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz
cpu MHz		: 3400.000

Restoring hypethreading, speedstep, i.e. returning to the normal 
configuration of a desktop system, maintains the ratio:

17384.8/12348.9=1.40