Crypto++ 3.1 Benchmarks

Seth Goodman writes:
> > Something to note here is that signing and verifying are
> > several orders of magnitude different in CPU complexity --
> > verifying being *much* cheaper. The SHA1 digest quickly
> > overcomes the RSA verify as the dominate factor... not to
> > mention that watching Spamassassin grind away trumps all...
>
>
> Hmm.  Something's rotten in Denmark.  There is a difference between signing
> and validating, but I don't recall it as being anywhere near an order of
> magnitude and certainly not multiple orders of magnitude.  

This is the chart I use. I somewhat misremembered the
"several" part as it's dependent on key size, but verifying
is significantly faster than signing. The 512 bit length --
possible an interesting one for this use -- is close to an
order of magnitude, though it's hard to say as the verify is
listed as zero which indicates rounding issues.

> The Sendmail
> benchmark above shows nearly identical results for signing and validating,
> which supports my recollection.  That data suggests that the test dual-CPU
> machine was capable of either creating or verifying on the order of 500 RSA
> signatures/second (I didn't find the key length used), if it was doing
> nothing else.  I'd guess that same machine can do around 5 million SHA1
> digests per second for short data blocks.  SHA1 HMAC's are a little slower,
> but similar to SHA1 digests.

I've not done the tests myself, but at some input length the
SHA1 work will dominate the entire workload. The chart I
attached seems to indicate that you get about 75 RSA Sig/Ghz
(@1024 bits) which seems roughly in line with the sendmail
test assuming they used a dual 3Ghz system. For
verification, the speed is about 3000 RSA verifications/Ghz,
so for the same test bed that's chugging out 500 RSA/sec,
you can get 10000 RSA verifications/sec -- I'd call that a
huge difference, and almost certainly down in the noise,
especially in comparison to the workload of the SHA1
computation.

> SpamAssassin is very slow, but you only run it on messages that pass
> authentication and have adequate sender reputation.  Presumably we will be
> rejecting a lot of mail due to either authentication failures or inadequate
> reputation.  If not, that means either the spam problem is solved or we're
> accepting all of it.

It would certainly be nice if we reduced much of the inbound
workload to a single RSA verify. That would be
*significantly* cheaper than the processing that's happening
now, especially if you could do it in memory before you
commit it to disk.

          Mike

Crypto++ 3.1 Benchmarks

Here are speed benchmarks for some of the most popular hash algorithms and symmetric and asymmetric ciphers. All were coded in C++ or ported to C++ from C implementations, compiled with Microsoft Visual C++ 6.0 SP2 (optimize for speed, Pentium Pro code generation), and ran on a Celeron 450MHz machine under Windows 2000 beta 3. No assembly language was used.

Cipher	Total Bytes	Time	Bytes/Second
MD2	8388608	21.01	399267
MD5	2147483648	37.534	57214356
SHA-1	536870912	21.12	25420024
HAVAL (pass=3)	1073741824	26.598	40369268
HAVAL (pass=4)	1073741824	36.343	29544668
HAVAL (pass=5)	536870912	22.532	23827042
Tiger	536870912	34.029	15776865
RIPE-MD160	536870912	22.232	24148566
MDC/MD5	536870912	34.72	15462871
Luby-Rackoff/MD5	134217728	27.65	4854167
DES	268435456	36.412	7372170
IDEA	134217728	21.01	6388278
RC2	67108864	22.643	2963779
RC5 (r=12)	536870912	20.629	26025058
Blowfish	268435456	29.783	9013043
Diamond2	67108864	22.202	3022649
Diamond2 Lite	134217728	37.144	3613443
3-WAY	201326592	20.519	9811716
TEA	134217728	24.115	5565736
SAFER (r=8)	134217728	25.416	5280836
GOST	134217728	25.727	5216999
SHARK (r=6)	268435456	20.981	12794216
CAST-128	268435456	29.762	9019403
Square	536870912	30.494	17605788
RC6	536870912	26.538	20230270
MARS	536870912	32.167	16690115
Rijndael	268435456	22.843	11751322
Twofish	268435456	26.398	10168780
Serpent	268435456	38.445	6982324
ARC4	268435456	20.499	13095051
SEAL	2147483648	35.161	61075728
WAKE	1073741824	24.906	43111772
Sapphire	268435456	39.426	6808590
MD5-MAC	1073741824	21.491	49962396
XMACC/MD5	1073741824	21.611	49684968
HMAC/MD5	2147483648	37.885	56684276
CBC-MAC/RC6	536870912	29.142	18422582
DMAC/RC6	536870912	29.472	18216304
BlumBlumShub 512	524288	20.249	25892
BlumBlumShub 1024	262144	24.415	10737
BlumBlumShub 2048	131072	34.27	3824

Operation	Iterations	Total Time	Milliseconds/Operation
RSA 512 Encryption	109491	30	0
RSA 512 Decryption	6886	30	4
Rabin 512 Encryption	17164	30	1
Rabin 512 Decryption	5128	30	5
BlumGoldwasser 512 Encryption	38882	30	0
BlumGoldwasser 512 Decryption	5667	30	5
LUC 512 Encryption	86813	30	0
LUC 512 Decryption	3411	30	8
ElGamal 512 Encryption	4257	30	7
ElGamal 512 Encryption with precomputation	7563	30	3
ElGamal 512 Decryption	8250	30	3
RSA 1024 Encryption	41051	30	0
RSA 1024 Decryption	1084	30	27
Rabin 1024 Encryption	7158	30	4
Rabin 1024 Decryption	959	30	31
BlumGoldwasser 1024 Encryption	16913	30	1
BlumGoldwasser 1024 Decryption	1014	30	29
LUC 1024 Encryption	31013	30	0
LUC 1024 Decryption	583	30	51
ElGamal 1024 Encryption	950	30	31
ElGamal 1024 Encryption with precomputation	2582	30	11
ElGamal 1024 Decryption	1861	30	16
LUCELG 512 Encryption	1952	30	15
LUCELG 512 Decryption	3601	30	8
RSA 2048 Encryption	13912	30	2
RSA 2048 Decryption	164	30.2	183
Rabin 2048 Encryption	2685	30	11
Rabin 2048 Decryption	158	30.1	190
BlumGoldwasser 2048 Encryption	5626	30	5
BlumGoldwasser 2048 Decryption	161	30.2	187
LUC 2048 Encryption	10278	30	2
LUC 2048 Decryption	93	30.2	324
ElGamal 2048 Encryption	210	30	142
ElGamal 2048 Encryption with precomputation	711	30	42
ElGamal 2048 Decryption	413	30	72
LUCELG 1024 Encryption	431	30	69
LUCELG 1024 Decryption	806	30	37
RSA 512 Signature	6919	30	4
RSA 512 Verification	113009	30	0
Rabin 512 Signature	4855	30	6
Rabin 512 Verification	16153	30	1
RW 512 Signature	5293	30	5
RW 512 Verification	375845	30	0
LUC 512 Signature	3392	30	8
LUC 512 Verification	89003	30	0
NR 512 Signature	8312	30	3
NR 512 Signature with precomputation	14585	30	2
NR 512 Verification	7190	30	4
NR 512 Verification with precomputation	8279	30	3
DSA 512 Signature	6318	30	4
DSA 512 Signature with precomputation	11306	30	2
DSA 512 Verification	5397	30	5
DSA 512 Verification with precomputation	6788	30	4
RSA 1024 Signature	1086	30	27
RSA 1024 Verification	43061	30	0
Rabin 1024 Signature	950	30	31
Rabin 1024 Verification	7203	30	4
RW 1024 Signature	970	30	30
RW 1024 Verification	187039	30	0
LUC 1024 Signature	583	30	51
LUC 1024 Verification	31682	30	0
NR 1024 Signature	1892	30	15
NR 1024 Signature with precomputation	5131	30	5
NR 1024 Verification	1601	30	18
NR 1024 Verification with precomputation	3190	30	9
DSA 1024 Signature	1950	30	15
DSA 1024 Signature with precomputation	5211	30	5
DSA 1024 Verification	1652	30	18
DSA 1024 Verification with precomputation	3183	30	9
LUCELG 512 Signature	3887	30	7
LUCELG 512 Verification	1952	30	15
RSA 2048 Signature	165	30	181
RSA 2048 Verification	14187	30	2
Rabin 2048 Signature	154	30	194
Rabin 2048 Verification	2769	30	10
RW 2048 Signature	156	30.1	192
RW 2048 Verification	69270	30	0
LUC 2048 Signature	93	30.2	324
LUC 2048 Verification	10337	30	2
NR 2048 Signature	415	30	72
NR 2048 Signature with precomputation	1416	30	21
NR 2048 Verification	373	30	80
NR 2048 Verification with precomputation	835	30	35
LUCELG 1024 Signature	861	30	34
LUCELG 1024 Verification	428	30.1	70
DH 512 Key-Pair Generation	8588	30	3
DH 512 Key-Pair Generation with precomputation	15315	30	1
DH 512 Agreement	5832	30	5
DH 1024 Key-Pair Generation	1924	30	15
DH 1024 Key-Pair Generation with precomputation	5254	30	5
DH 1024 Agreement	1512	30	19
DH 2048 Key-Pair Generation	421	30	71
DH 2048 Key-Pair Generation with precomputation	1438	30	20
DH 2048 Agreement	364	30.1	82
MQV 512 Key-Pair Generation	8591	30	3
MQV 512 Key-Pair Generation with precomputation	14891	30	2
MQV 512 Key Agreement	4600	30	6
MQV 1024 Key-Pair Generation	1918	30	15
MQV 1024 Key-Pair Generation with precomputation	5233	30	5
MQV 1024 Key Agreement	1042	30.1	28
MQV 2048 Key-Pair Generation	422	30.1	71
MQV 2048 Key-Pair Generation with precomputation	1434	30	20
MQV 2048 Key Agreement	238	30.2	127
EC over GF(p) 168 Encryption	941	30	31
EC over GF(p) 168 Encryption with precomputation	2083	30	14
EC over GF(p) 168 Decryption	1876	30	15
EC over GF(p) 168 NR Signature	1876	30	15
EC over GF(p) 168 NR Signature with precomputation	4120	30	7
EC over GF(p) 168 NR Verification	1094	30	27
EC over GF(p) 168 NR Verification with precomputation	2461	30	12
EC over GF(p) 168 DHC Key-Pair Generation	1881	30	15
EC over GF(p) 168 DHC Key-Pair Generation with precomputation	4150	30	7
EC over GF(p) 168 DHC Agreement	1880	30	15
EC over GF(p) 168 MQVC Key-Pair Generation	1880	30	15
EC over GF(p) 168 MQVC Key-Pair Generation with precomputation	4150	30	7
EC over GF(p) 168 MQVC Key Agreement	1048	30	28
EC over GF(2^n) 155 Encryption	767	30	39
EC over GF(2^n) 155 Encryption with precomputation	2279	30	13
EC over GF(2^n) 155 Decryption	1506	30	19
EC over GF(2^n) 155 Signature	1491	30	20
EC over GF(2^n) 155 Signature with precomputation	4516	30	6
EC over GF(2^n) 155 Verification	1224	30	24
EC over GF(2^n) 155 Verification with precomputation	2636	30	11
EC over GF(2^n) 155 DHC Key-Pair Generation	1536	30	19
EC over GF(2^n) 155 DHC Key-Pair Generation with precomputation	4556	30	6
EC over GF(2^n) 155 DHC Agreement	1530	30	19
EC over GF(2^n) 155 MQVC Key-Pair Generation	1533	30	19
EC over GF(2^n) 155 MQVC Key-Pair Generation with precomputation	4570	30	6
EC over GF(2^n) 155 MQVC Key Agreement	1202	30	24

Notes

• Crypto++ 3.1 Benchmark Average for this platform: 1451.428. This number is computed by taking the geometric mean of the number of bytes/second of each cipher, hash function, and MAC, and operations/second of each crypto operation listed above.
• RSA and LUC use 17 as the public exponent.
• DH and ElGamal encryption and decryption use short exponents to save time. The size of the secret exponents were chosen so that a meet-in-the-middle attack would be slower than the general discrete log algorithm. The sizes used were:

  modulus	exponent
  512	122
  1024	166
  2048	228

• BlumGoldwasser is timed on a 16-byte plaintext. The lowest log(log(n)) bits of each square are used.
• EC means elliptic curve. Operations in GF(2^n) are implemented using trinomial basis.
• All tests were done by repeating the crypto operations over small blocks of random (and changing) data. In practice you will likely see slower speeds because time is needed to transfer data to and from memory.
• For the ciphers that specify big endian byte order, the timing data listed include time needed to convert to and from little endian order. For some ciphers (WAKE and SHA) this is a large fraction (up to 25%) of the total time.
• The RSA, RW, DH, MQV, and elliptic curve schemes come from the IEEE P1363 draft standard. For more info see http://grouper.ieee.org/groups/1363/index.html.
• Precomputation means using a table of 16 precomputed powers of each fixed base to speed up exponentiation.
• Tiger and SHARK are designed to take advantage of 64-bit word operations. Their relatives speeds can be expected to be much higher if the benchmarks were done on a 64-bit CPU.
• These tables may not be displayed properly with a browser (such as Navigator 4.5 or Opera 3.51) that doesn't adequately implement HTML 4.0 and CSS. Internet Explorer 4.0 and above seem to render them correctly, so I suggest that you .

---

Written by: Wei Dai <weidai(_at_)eskimo(_dot_)com> Last modified: 4/30/1999

--------------FF915ABC7C118129709836DE--