Subject: Re: [core] Choice of signature Algorithm(s) in Group OSCORE

From: Mehmet Adalier <[email-masked]>
Date: Thu, 21 Mar 2019 14:46:09 -0700

John,

My suggestion is to stay with the ECDSA secp256r1 curve. It is safer (128-bit strength) and fast implementations do exist. See 1.

Here are perf numbers using our taraCRYPT(tm) engine on ARM64 A53 (1.2GHz). 
ECC-P256 Keygen: 6,269 Ops/sec; ECC-P256 Sign: 5,987 Ops/sec; ECC-P256 Verify: 3,288 Ops/sec
And on late generation 3.8GHz X86..
ECC-P256 Keygen: 85,631 Ops/sec; ECC-P256 Sign: 73,706 Ops/sec; ECC-P256 Verify: 59,530 Ops/sec

The ARM port can be further optimized. 

As a reference, we have implemented an adaptation of CoAP over the Bundle Protocol for space use. We utilize ECDSA secp256r1. for a summary see 2.

1.	M. Adalier, “Efficient and Secure Elliptic Curve Cryptography Implementation of Curve P-256,” NIST Workshop on Elliptic Curve Cryptography Standards, June 11, 2015
2.	M. Adalier, S. Burleigh, "Cross-domain Autonomous Communication Protocol for Delay Tolerant Networks," NAECON 2018, Proceedings of the IEEE 2018 National Aerospace and Electronics Conference: Dayton, OH, July 2018

Best,

Mehmet Adalier
Antara Teknik LLC

On 3/21/19, 2:09 PM, "core on behalf of John Mattsson" <[email-masked] on behalf of [email-masked]> wrote:

     I think we need some more discussion of which signature algorithms to use. Candidates would be:
    
    Algorithm                                Signature size     Security level
    ECDSA secp224r1 (P-224)    56 bytes               112
    ECDSA secp256r1 (P-256)    64 bytes               128
    ECDSA secp256k1                  64 bytes               128
    Ed25519                                  64 bytes               128
    
    The CFRG review of EDHOC brought up the qeustion if not P-224 would be a better choice if the main goal is to get smaller messages. ECDSA with P-224 has the obvious advantage of having signatures that are 8 bytes shorter.
    
    112-bit security is according to NIST ok to use until 2030.
    
    ECDSA wih P-224 is significantly faster than ECDSA with P-256, around 2/3 the number of operations/time. secp256k1 is around 300 % faster than secp256r1. Harder to find comparisions with Ed25519. Most of the speed will depend on the curve, but EdDSA (Schnorr) also have other advantages that speed up signing compared to ECDSA. Ed25519 verify is likely at least as fast as ECDSA with P-224 on all platforms and significantly faster for signing on all platforms. On some platforms I think Ed25519 is significantly faster also for verification.
    
    In terms of number of implementation, I think ECDSA with P-256 in is the lead, with ECDSA P-224 as second, and Ed25519 in last place.
    
    I am leaning towards that P-224 should probably be supported (then ES224 need to be standardized in COSE). The other three are already registered for COSE. The harder question is which should be MTI. Several people have stated that latency is of uthermost importance, in case the current choice of Ed25519 as MTI is likely the correct choice.
    
    A good but a little bit dated comparision of different algorithms on ARM processors:
    https://datatracker.ietf.org/meeting/92/materials/slides-92-lwig-3
    
    The choice also depends on if there are fast implementations available. Assembly optimized version of the NIST curves is likely as fast or faster than a curve25519 implementation written in C.
    
    https://github.com/kmackay/micro-ecc has very fast implementations (for ARM) of ECDH and ECDSA with secp160r1, secp192r1, secp224r1, secp256r1, and secp256k1. I cannot find anything similar for EdDSA.
    
    Cheers,
    John
    
    _______________________________________________
    core mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/core