diff options
author | Jack Lloyd <[email protected]> | 2016-10-13 14:36:28 -0400 |
---|---|---|
committer | Jack Lloyd <[email protected]> | 2016-10-13 14:36:28 -0400 |
commit | 30c85ac981fdad46639ce02aa7e8612601fc5245 (patch) | |
tree | 57f2b22d4b3bbaf21a9849f724fd5f8c86544c4e | |
parent | 837ff4ee24cb302da0a17e07ebab8ab1ef9204ca (diff) |
Add OS2ECP benchmark.
Turns out decompressing a point is ~50x slower than checking (x,y)
is on the curve. Update relnote accordingly.
-rw-r--r-- | doc/news.rst | 8 | ||||
-rw-r--r-- | src/cli/speed.cpp | 36 |
2 files changed, 38 insertions, 6 deletions
diff --git a/doc/news.rst b/doc/news.rst index ad3015082..80a8457e3 100644 --- a/doc/news.rst +++ b/doc/news.rst @@ -13,12 +13,8 @@ Version 1.11.33, Not Yet Released * Add support for the TLS Supported Point Formats Extension from RFC 4492. Adds TLS::Policy::use_ecc_point_compression policy option. If supported on both - sides, ECC points can be sent in compressed format, which both saves a few - bytes on the wire and is an inexpensive way of avoiding invalid curve attacks. - For uncompressed points Botan already checks that the point is on the curve so - invalid curve attacks are not possible in either situation, but the point - decompression will typically be cheaper than verifying the point is on the - curve. (GH #645) + sides, ECC points can be sent in compressed format which saves a few bytes + during the handshake. (GH #645) * Fix entropy source selection bug on Windows, which caused the CryptoAPI entropy source to be not available under its normal name "win32_cryptoapi" but diff --git a/src/cli/speed.cpp b/src/cli/speed.cpp index d864c5858..b44c6df99 100644 --- a/src/cli/speed.cpp +++ b/src/cli/speed.cpp @@ -88,6 +88,10 @@ #include <botan/chacha.h> #endif +#if defined(BOTAN_HAS_ECC_GROUP) + #include <botan/ec_group.h> +#endif + namespace Botan_CLI { namespace { @@ -426,6 +430,12 @@ class Speed final : public Command bench_fpe_fe1(msec); } #endif +#if defined(BOTAN_HAS_ECC_GROUP) + else if(algo == "os2ecp") + { + bench_os2ecp(msec); + } +#endif else if(algo == "RNG") { #if defined(BOTAN_HAS_AUTO_SEEDING_RNG) @@ -659,6 +669,32 @@ class Speed final : public Command } } +#if defined(BOTAN_HAS_ECC_GROUP) + void bench_os2ecp(const std::chrono::milliseconds runtime) + { + Timer uncmp_timer("OS2ECP uncompressed"); + Timer cmp_timer("OS2ECP compressed"); + + const Botan::EC_Group group("secp256r1"); + const Botan::CurveGFp& curve = group.get_curve(); + + while(uncmp_timer.under(runtime) && cmp_timer.under(runtime)) + { + const Botan::BigInt k(rng(), 256); + const Botan::PointGFp p = group.get_base_point() * k; + const Botan::secure_vector<uint8_t> os_cmp = Botan::EC2OSP(p, Botan::PointGFp::COMPRESSED); + const Botan::secure_vector<uint8_t> os_uncmp = Botan::EC2OSP(p, Botan::PointGFp::UNCOMPRESSED); + + uncmp_timer.run([&] { OS2ECP(os_uncmp, curve); }); + cmp_timer.run([&] { OS2ECP(os_cmp, curve); }); + } + + output() << Timer::result_string_ops(uncmp_timer); + output() << Timer::result_string_ops(cmp_timer); + } + +#endif + #if defined(BOTAN_HAS_FPE_FE1) void bench_fpe_fe1(const std::chrono::milliseconds runtime) |