1355993 - ECDSA signature verification is too slow (P256)

Status: NEW

(NSS :: Libraries, enhancement, P2)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: signatures.cpp

See bug 1353216, wherein we discovered that the EC signature verifications Firefox was doing as part of gathering certificate transparency telemetry noticeably slowed down the TLS handshake.

Long story short is that EC signature verifications are slower than it seems like they should be.

I'm attaching a short program that generates a key (ec or rsa), signs a hash, and then repeatedly verifies the signature to demonstrate the difference:

keeler@p710 ~/scratch/signatures $ time ./signatures --ec
generated key pair...
signed hash...
verified signature(s)

real	0m5.122s
user	0m5.113s
sys	0m0.002s
keeler@p710 ~/scratch/signatures $ time ./signatures --rsa
generated key pair...
signed hash...
verified signature(s)

real	0m1.743s
user	0m1.740s
sys	0m0.000s

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: Makefile

Comment 2

[Franziskus Kiefer [:franziskus]]

Well, I'm not surprised that ECDSA is slower than RSA verification. That's probably something we can't change. But it should be faster nonetheless. Given that P256 is already the fastest curve (for DSA) we have we have to do something here. I'll try to make a plan.

Comment 3

[Michel Le Bihan]

Hello,
Is there any progress on this? I noticed that on amd64 OpenSSL ecdsap256 is roughly the same speed as rsa4096 and on a Raspberry pi 4 it's twice as fast.

Comment 4

[Michel Le Bihan]

Attachment: openssl_speed.txt

Comment 5

[Michel Le Bihan]

Since the provided benchmark of NSS only counted total time, I changed it to measure time of the steps:

michel@debian:/dev/shm$ ./signatures --rsa
1016 microsec: started generating key pair...
963330 microsec: generated key pair...
14814 microsec: signed hash...
2186489 microsec: verified signature(s)
michel@debian:/dev/shm$ ./signatures --ec
1018 microsec: started generating key pair...
3089 microsec: generated key pair...
367 microsec: signed hash...
8204261 microsec: verified signature(s)