From 7274f8ae4040dd25f02cd49eef6d2654c8dc8b3e Mon Sep 17 00:00:00 2001 From: Ken MacKay Date: Mon, 10 Jun 2013 22:29:10 -0700 Subject: [PATCH] Updated features and size/speed numbers for new point multiplication algorithm. --- index.md | 226 +++++++++++-------------------------------------------- 1 file changed, 43 insertions(+), 183 deletions(-) diff --git a/index.md b/index.md index b3a6c4f..ae16af6 100644 --- a/index.md +++ b/index.md @@ -11,19 +11,17 @@ A small ECDH and ECDSA implementation for 32-bit microcontrollers. Features -------- - * BSD 2-clause license. + * Resistant to known side-channel attacks. * Written in C, with optional inline assembly for ARM and Thumb platforms. - * Small code size: as low as 1800 bytes when compiled for Thumb (eg, Cortex-M0). + * Small code size: ECDH in as little as 2KB, ECDH + ECDSA in as little as 3KB when compiled for Thumb (eg, Cortex-M0). * No dynamic memory allocation. - * Reasonably fast: on an LPC1114 at 48MHz (ARM Cortex-M0, 32-cycle 32x32 bit multiply), 192-bit ECDH shared secret calculation takes as little as ~150ms (depending on selected optimizations). + * Reasonably fast: on an LPC1114 at 48MHz (ARM Cortex-M0, 32-cycle 32x32 bit multiply), 192-bit ECDH shared secret calculation takes as little as ~175ms (depending on selected optimizations). * Support for 4 standard curves: secp128r1, secp192r1, secp256r1, and secp384r1 - * Optional optimizations so you can choose between code size and speed. + * BSD 2-clause license. Usage Notes ----------- -**NOTE:** This implementation is not designed to be resistant to timing attacks or other side-channel attacks. To thwart timing attacks, you can use a timer to ensure that all ECDH operations take the same amount of time (ie, the longest time it would ever take). You can determine the maximum time for ECDH by using a private key that is all 0xffffffff. - #### Integer Representation #### To reduce code size, all large integers are represented using little-endian words - so the least significant word is first. For example, the standard representation of the prime modulus for the curve secp128r1 is `FFFFFFFD FFFFFFFF FFFFFFFF FFFFFFFF`; in micro-ecc, this would be represented as `uint32_t p[4] = {0xffffffff, 0xffffffff, 0xffffffff, 0xfffffffd};`. @@ -43,7 +41,6 @@ Speed and Size Available optimizations are: * `ECC_SQUARE_FUNC` - Use a separate function for squaring. - * `ECC_USE_NAF` - Use a non-adjacent form for scalar representation when doing point multiplication. * `ECC_ASM` - Choose the type of inline assembly to use. The available options are `ecc_asm_none`, `ecc_asm_thumb`, `ecc_asm_thumb2`, and `ecc_asm_arm`. All tests were performed on an LPC1114 running at 48MHz. The listed code sizes include all code and data required by the micro-ecc library (including `aebi_lmul` when not using assembly), @@ -55,9 +52,7 @@ The following compiler options were used (using gcc 4.8): ### Effect of optimization settings ### -These tests were performed using the curve secp192r1. Only ECDH code was used (no ECDSA). - -#### ECC_ASM defined to ecc_asm_none #### +These tests were performed using the curve secp192r1. Only ECDH code was used (no ECDSA). When enabled, ECC_ASM was defined to `ecc_asm_thumb`. @@ -67,61 +62,29 @@ These tests were performed using the curve secp192r1. Only ECDH code was used (n - - + + - - - - - - - - - - - + -
none431.91948438.92212
ECC_SQUARE_FUNC393.02152
ECC_USE_NAF369.52208
both337.2406.7 2412
- -#### ECC_ASM defined to ecc_asm_thumb #### - - - - - - - - - - - - - - - - - - - - + + + - - + +
OptimizationsECDH time (ms)Code size (bytes)
none183.91772
ECC_SQUARE_FUNC172.61920
ECC_USE_NAF158.22032ECC_ASM186.32036
both147.72180175.72170
### ECDH for different curves ### -In these tests, `ECC_ASM` was defined to `ecc_asm_thumb` in all cases. - -#### No other optimizations (smallest code size) #### +In these tests, `ECC_ASM` was defined to `ecc_asm_thumb` and `ECC_SQUARE_FUNC` was defined to `1` in all cases. @@ -133,51 +96,23 @@ In these tests, `ECC_ASM` was defined to `ecc_asm_thumb` in all cases. - - - - + + + + - - - - - -
ECDH time (ms):85.5183.9473.61405.889.9175.7465.11370.3
Code size (bytes):1908177221041832
- -#### All optimizations (fastest) #### - - - - - - - - - - - - - - - - - - - - - + + +
secp128r1secp192r1secp256r1secp384r1
ECDH time (ms):75.9147.7385.81128.2
Code size (bytes):233221802516232421702512 2244
### ECDSA speed and combined code size ### -In these tests, the measured speed is the time to verify an ECDSA signature. The measured code size is the combined code size for ECDH and ECDSA. `ECC_ASM` was defined to `ecc_asm_thumb` in all cases. - -#### No other optimizations (smallest code size) #### +In these tests, the measured speed is the time to verify an ECDSA signature. The measured code size is the combined code size for ECDH and ECDSA. `ECC_ASM` was defined to `ecc_asm_thumb` and `ECC_SQUARE_FUNC` was defined to `1` in all cases. @@ -189,51 +124,23 @@ In these tests, the measured speed is the time to verify an ECDSA signature. The - - - - + + + + - - - - - -
ECDSA verify time (ms):108.6230.6590.21729.7106.7217.1555.21576.1
Code size (bytes):2638252628462674
- -#### All optimizations (fastest) #### - - - - - - - - - - - - - - - - - - - - - - + + + +
secp128r1secp192r1secp256r1secp384r1
ECDSA verify time (ms):108.0219.0558.51615.0
Code size (bytes):30462918324830623138301433343158
### Maximum stack usage ### -In these tests, `ECC_ASM` was defined to `ecc_asm_thumb` in all cases. The table values are the maximum possible stack usage for each function, in bytes. - -#### No other optimizations (smallest code size) #### +In these tests, `ECC_ASM` was defined to `ecc_asm_thumb` and `ECC_SQUARE_FUNC` was defined to `1` in all cases. The table values are the maximum possible stack usage for each function, in bytes. @@ -245,57 +152,10 @@ In these tests, `ECC_ASM` was defined to `ecc_asm_thumb` in all cases. The table - - - - - - - - - - - - - - + - - - - - - - - - - - - - - - - -
ecc_make_key()392488624848
ecc_valid_public_key()184224304416
ecdh_shared_secret()336 416 528680936
ecdsa_sign()448568 7281000
ecdsa_verify()4806167921096
- -#### All optimizations (fastest) #### - - - - - - - - - - - - - - - @@ -306,23 +166,23 @@ In these tests, `ECC_ASM` was defined to `ecc_asm_thumb` in all cases. The table - - + + + - - - - - + + + + - - - - + + + +
secp128r1secp192r1secp256r1secp384r1
ecc_make_key()4726007601056
ecc_valid_public_key()
ecdh_shared_secret()496640360456584 8161144
ecdsa_sign()5286808641208400504640888
ecdsa_verify()4886247921104400520672952