FFDH and ECDH benchmarks

[ocheron]

This is rather TLS-oriented but shows how cryptonite implementations compare to each others.

Using cryptonite-0.24 and GHC 8.2.1:

benchmarking DH/FFDH/2048
time                 326.8 μs   (325.0 μs .. 330.0 μs)
                     1.000 R²   (0.999 R² .. 1.000 R²)
mean                 324.9 μs   (324.5 μs .. 326.4 μs)
std dev              2.406 μs   (1.004 μs .. 5.001 μs)

benchmarking DH/FFDH/3072
time                 821.4 μs   (817.0 μs .. 826.6 μs)
                     1.000 R²   (1.000 R² .. 1.000 R²)
mean                 820.6 μs   (818.4 μs .. 824.0 μs)
std dev              9.193 μs   (7.137 μs .. 12.31 μs)

benchmarking DH/FFDH/4096
time                 1.639 ms   (1.629 ms .. 1.649 ms)
                     1.000 R²   (1.000 R² .. 1.000 R²)
mean                 1.636 ms   (1.632 ms .. 1.642 ms)
std dev              16.49 μs   (12.19 μs .. 24.68 μs)

benchmarking DH/FFDH/6144
time                 3.340 ms   (3.332 ms .. 3.345 ms)
                     1.000 R²   (1.000 R² .. 1.000 R²)
mean                 3.360 ms   (3.350 ms .. 3.382 ms)
std dev              44.64 μs   (20.01 μs .. 72.97 μs)

benchmarking DH/FFDH/8192
time                 5.558 ms   (5.532 ms .. 5.603 ms)
                     1.000 R²   (1.000 R² .. 1.000 R²)
mean                 5.552 ms   (5.544 ms .. 5.565 ms)
std dev              29.00 μs   (18.45 μs .. 49.21 μs)

benchmarking DH/ECDH/P256R1
time                 468.0 μs   (467.7 μs .. 468.2 μs)
                     1.000 R²   (1.000 R² .. 1.000 R²)
mean                 467.9 μs   (467.5 μs .. 468.6 μs)
std dev              1.568 μs   (785.3 ns .. 2.925 μs)

benchmarking DH/ECDH/P384R1
time                 3.029 ms   (3.011 ms .. 3.044 ms)
                     1.000 R²   (1.000 R² .. 1.000 R²)
mean                 3.017 ms   (3.013 ms .. 3.024 ms)
std dev              18.05 μs   (14.35 μs .. 23.99 μs)

benchmarking DH/ECDH/P521R1
time                 5.630 ms   (5.612 ms .. 5.644 ms)
                     1.000 R²   (1.000 R² .. 1.000 R²)
mean                 5.632 ms   (5.626 ms .. 5.640 ms)
std dev              20.80 μs   (16.31 μs .. 29.03 μs)

benchmarking DH/ECDH/X25519
time                 51.84 μs   (51.79 μs .. 51.90 μs)
                     1.000 R²   (1.000 R² .. 1.000 R²)
mean                 51.67 μs   (51.63 μs .. 51.72 μs)
std dev              163.0 ns   (133.9 ns .. 210.2 ns)

benchmarking DH/ECDH/X448
time                 181.1 μs   (181.0 μs .. 181.3 μs)
                     1.000 R²   (1.000 R² .. 1.000 R²)
mean                 180.8 μs   (180.7 μs .. 180.9 μs)
std dev              311.5 ns   (255.8 ns .. 423.0 ns)

[vincenthz]

Cool benchs. glad to see it concretely, and also that seems to also go with the expected profile of those different curves/implementations.

[ocheron]

Yes, the performance of P256 was a bit disappointing compared to X25519 and X448 but there's a simple explanation: it's 32-bit only.