4 ms·

(1) Interesting that this is presented as a webpage instead of a normal paper on eprint or arxiv. (2) If Mike Hamburg is behind it (no author information is av

by abhv 8y ago

(1) Interesting that this is presented as a webpage instead of a normal paper on eprint or arxiv. (2) If Mike Hamburg is behind it (no author information is available on the page), then it has high credibility. I would take objection to the following statement: "However, modern elliptic curve implementations with fast, simple formulas don't provide a prime-order group." The Broker-Stevanhagen (and prior) methods can find good curves with prime order, and complete formulas for these curves that are reasonably efficient are given by Renes, Costello, and Batina in https://eprint.iacr.org/2015/1060 https://eprint.iacr.org/2015/1060 So this performance knife-fight in the ellpitic curve streets may require some benchmarks to resolve.

bascule 8y ago
From my benchmarks (oh hi I'm the author of a multi-provider elliptic curve digital signature library for Rust), ed25519-dalek (with curve25519-dalek's AVX2 backend) seems to be winning: https://twitter.com/bascule/status/1024313525554925568 https://twitter.com/bascule/status/1024313525554925568 ...for both signing and verification, beating out the fiat-crypto P-256 implementation (in ring, a Rust cryptography library that wraps BoringCrypto). libsecp256k1 seems slightly slower than fiat-crypto's P-256, even with the endomorphism optimization enabled. The Rust crate presently provide knobs for either of these things, hence the low Signatory benchmarks. These curves predate Broker-Stevanhagen, however all of the implementations I'm comparing are production(-ish) quality.
FiloSottile 8y ago
I believe that would be an extremely quick fight. The formulas you mention are 50% slower than Edwards formulas, and on top of that they don’t parallelize: https://medium.com/@hdevalence/accelerating-edwards-curve-arithmetic-with-parallel-formulas-ac12cf5015be https://medium.com/@hdevalence/accelerating-edwards-curve-ar... (from the same author as Ristretto). Re (1), AFAIK the author does not consider Ristretto finished by their extremely high (IMHO) standard.
- floodyberry- 8y ago
  Not to volunteer, but they can be parallelized, just not in the same manner as dalek. Even with the schnorr-style signatures (to avoid scalar inversions) and the endomorphism I still think it'd be slower, the group ops are nasty.

by abhv 8y ago

bascule 8y ago

From my benchmarks (oh hi I'm the author of a multi-provider elliptic curve digital signature library for Rust), ed25519-dalek (with curve25519-dalek's AVX2 backend) seems to be winning: https://twitter.com/bascule/status/1024313525554925568 https://twitter.com/bascule/status/1024313525554925568 ...for both signing and verification, beating out the fiat-crypto P-256 implementation (in ring, a Rust cryptography library that wraps BoringCrypto). libsecp256k1 seems slightly slower than fiat-crypto's P-256, even with the endomorphism optimization enabled. The Rust crate presently provide knobs for either of these things, hence the low Signatory benchmarks. These curves predate Broker-Stevanhagen, however all of the implementations I'm comparing are production(-ish) quality.

FiloSottile 8y ago

I believe that would be an extremely quick fight. The formulas you mention are 50% slower than Edwards formulas, and on top of that they don’t parallelize: https://medium.com/@hdevalence/accelerating-edwards-curve-arithmetic-with-parallel-formulas-ac12cf5015be https://medium.com/@hdevalence/accelerating-edwards-curve-ar... (from the same author as Ristretto). Re (1), AFAIK the author does not consider Ristretto finished by their extremely high (IMHO) standard.

floodyberry- 8y ago
Not to volunteer, but they can be parallelized, just not in the same manner as dalek. Even with the schnorr-style signatures (to avoid scalar inversions) and the endomorphism I still think it'd be slower, the group ops are nasty.