Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mirage-crypto-ec: add 25519 #107

merged 1 commit into from Mar 30, 2021

mirage-crypto-ec: add 25519 #107

merged 1 commit into from Mar 30, 2021


Copy link

@hannesm hannesm commented Mar 10, 2021

  • add ED25519
  • figure out performance (whether to move scalar_mult + inversion to C to avoid lots of OCaml -> C calls)

@hannesm hannesm force-pushed the 25519 branch 2 times, most recently from 4099a3e to 7cc310b Compare March 15, 2021 19:35
@hannesm hannesm changed the title mirage-crypto-ec: add X25519 with scalar multiplication and inversion in OCaml mirage-crypto-ec: add X25519 Mar 15, 2021
Copy link
Member Author

hannesm commented Mar 15, 2021

I evaluated the performance using the 5 existing X25519 implementations (I did not use hacl since it is abandoned (superseeded by hacl-star and conflicts with hacl_x25519) available on opam:

  • __44.676 kex/s using callipyge 0.2 (pure OCaml)
  • 1792.651 kex/s using hacl_x25519 0.2.2 (our HACL C bindings)
  • _200.734 kex/s using rfc7748 1.0 (OCaml using Zarith / gmp)
  • 1803.398 kex/s using hacl-star 0.3.2 (official HACL binding using ctypes (used by tezos), not available on BSD or 32 bit platforms)
  • _560.714 kex/s using mirage-crypto-ec with inversion and scalar multiplication in OCaml (cfe466f)
  • 1714.683 kex/s using mirage-crypto-ec with inversion and scalar multiplication in C (7cc310b)

I only ran the key exchange (i.e. a scalar multiplication), and compared the result for correctness (String.equal / Bytes.equal / Cstruct.equal). Conversions of private and public were done upfront once. Each library did as many key exchanges as it could in 10s.

Since the C code is boring (taken from BoringSSL), I do not see a reason to retain the arithmetic instructions in OCaml (esp. since it is a pretty high price to pay for all the OCaml<->C calling). Heap allocation still happens on the OCaml side, though memmove and memset is used on the C side.

Copy link

Seems very good 🎉!

@hannesm hannesm mentioned this pull request Mar 15, 2021
6 tasks
@hannesm hannesm changed the title mirage-crypto-ec: add X25519 mirage-crypto-ec: add 25519 Mar 29, 2021
Code originates mostly from (a) fiat-crypto and (b) boringssl
Tests from RFC 7748, RFC 8032, and wycheproof
@hannesm hannesm merged commit 02c76d8 into mirage:main Mar 30, 2021
@hannesm hannesm deleted the 25519 branch March 30, 2021 09:07
kit-ty-kate pushed a commit to ocaml/opam-repository that referenced this pull request Mar 31, 2021
…ge-crypto-rng, mirage-crypto-rng-mirage and mirage-crypto-rng-async (0.9.0)


- Elliptic curve support in the new package mirage-crypto-ec

  The arithmetic code is generated by
  [fiat-crypto](, a development in Coq
  which includes proofs of constant time behaviour. The generation can be
  reproduced (see ec/native/GNUmakefile).

  The group operation implementations are taken from BoringSSL. The high-level
  mechanisms (signature DSA and key exchange ECDH) are implemented in OCaml.
  The ECDSA implementation (as our DSA one) uses a deterministic k (RFC 6979).

  The NIST curves P224 (SECP224R1), P256 (SECP256R1), P384 (SECP384R1), and
  P521 (SECP521R1) are supported (ECDH and ECDSA), in addition to Curve25519
  (X25519 and Ed25519).

  Performance of X25519 has been measured and is roughly the same as
  the hacl_x25519 and also the hacl opam package (see mirage/mirage-crypto#107 for numbers).

  Tests vectors are from RFCs and wycheproof.

  Import mirage/fiat repository (@pascutto @emillon @NathanReb @hannesm mirage/mirage-crypto#101)
  Check bounds of message (reported by @greg42, fixed by @hannesm mirage/mirage-crypto#108)
  Remove blinding, since constant time arithmetics is used (@hannesm mirage/mirage-crypto#106)
  Curve 25519 (X25519 & Ed25519) support (@hannesm mirage/mirage-crypto#107 imported from BoringSSL)

  Partially reviewed by @JasonGross @avsm @dinosaure
  Partially sponsored by Nitrokey GmbH
Copy link
Member Author

hannesm commented Feb 25, 2024

FWIW, see #202 (comment) for an updated table, and a utility (bench/ec.exe) to generate such a table.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
None yet

Successfully merging this pull request may close these issues.

None yet

2 participants