Subject: [IPsec] P-256 speed

From: Stephen Kent <[email-masked]>
Date: Tue, 21 Jul 2015 10:57:02 +0200

I checked with the NIST folks and their contractor. The answer is that 
their sign
operations _are_ constant time. The attached paper describes their work 
in the
context of BGPsec, because that was the motivation at NIST for exploring 
performance
improvements for P-256. There is one table (3) that also compares P-256 
code to 25591
in terms of signature performance. I realize that we were discussing 
ECDH, not ECDSA,
for IKE(v2) but I believe the performance numbers cited in this paper 
are indicative
of what one would see in that context as well.

Steve

---

From: Yoav Nir <[email-masked]>
Date: Sat, 25 Jul 2015 17:10:23 +0300

Is this code available anywhere? If not, it makes it hard to reproduce their results.

It’s too bad they don’t submit this to bench.cr.yp.to so we could have an apples-to-apples comparison with other implementations.

Yoav

> On Jul 21, 2015, at 11:57 AM, Stephen Kent <[email-masked]> wrote:
> 
> I checked with the NIST folks and their contractor. The answer is that their sign
> operations are constant time. The attached paper describes their work in the
> context of BGPsec, because that was the motivation at NIST for exploring performance
> improvements for P-256. There is one table (3) that also compares P-256 code to 25591 
> in terms of signature performance. I realize that we were discussing ECDH, not ECDSA,
> for IKE(v2) but I believe the performance numbers cited in this paper are indicative 
> <Efficient and Secure ECC Implementation of Curve  P-256  vf.pdf>_______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec