Curve25519: Which public-key systems new Diffie-Hellman speed records are smallest? Fastest? D. J. Bernstein Real-world cost measures: Pentium cycles, Athlon cycles, Thanks to: etc. for generating keys, signing, University of Illinois at Chicago verifying, encrypting, decrypting; Danmarks Tekniske Universitet key bytes, signed-message bytes, Alfred P. Sloan Foundation ciphertext bytes, etc. More useful than simplified cost measures, although harder to analyze.
Which public-key systems eBATS (ECRYPT Diffie-Hellman speed records are smallest? Fastest? of Asymmetric Systems): new project to measure Real-world cost measures: time and space consumed Pentium cycles, Athlon cycles, public-key signature etc. for generating keys, signing, Illinois at Chicago public-key encryption verifying, encrypting, decrypting; ekniske Universitet public-key secret-sha key bytes, signed-message bytes, Foundation ciphertext bytes, etc. http://ebats.cr.yp.to More useful than simplified cost measures, although harder to analyze.
Which public-key systems eBATS (ECRYPT Benchmarking are smallest? Fastest? of Asymmetric Systems): new project to measure Real-world cost measures: time and space consumed by Pentium cycles, Athlon cycles, public-key signature systems, etc. for generating keys, signing, public-key encryption systems, verifying, encrypting, decrypting; public-key secret-sharing systems. key bytes, signed-message bytes, ciphertext bytes, etc. http://ebats.cr.yp.to More useful than simplified cost measures, although harder to analyze.
ey systems eBATS (ECRYPT Benchmarking This talk’s scope astest? of Asymmetric Systems): Focus on private new project to measure cost measures: ssh, email, purchasing, time and space consumed by cycles, Athlon cycles, Typical setup: public-key signature systems, generating keys, signing, Each communicating public-key encryption systems, encrypting, decrypting; has a long-term secret public-key secret-sharing systems. signed-message bytes, and a long-term public ytes, etc. http://ebats.cr.yp.to Alice authenticates than encrypts messages measures, using Alice’s secret rder to analyze. and Bob’s public Bob verifies and decrypts using Alice’s public and Bob’s secret
eBATS (ECRYPT Benchmarking This talk’s scope of Asymmetric Systems): Focus on private communications: new project to measure ssh, email, purchasing, etc. time and space consumed by Typical setup: public-key signature systems, Each communicating party public-key encryption systems, has a long-term secret key public-key secret-sharing systems. and a long-term public key. http://ebats.cr.yp.to Alice authenticates and encrypts messages to Bob using Alice’s secret key and Bob’s public key. Bob verifies and decrypts using Alice’s public key and Bob’s secret key.
(ECRYPT Benchmarking This talk’s scope This talk’s recommendations Systems): Focus on private communications: The “asymmetric” measure ssh, email, purchasing, etc. Alice, Bob use Curve25519 consumed by compute long-term Typical setup: signature systems, from secret keys, Each communicating party encryption systems, Note: minimal asymmetric has a long-term secret key secret-sharing systems. and a long-term public key. The “symmetric” http://ebats.cr.yp.to Alice, Bob use sha Alice authenticates and as key for Poly1305+Salsa20 encrypts messages to Bob to authenticate+encrypt using Alice’s secret key and Bob’s public key. Curve25519 is the Bob verifies and decrypts if there aren’t many using Alice’s public key This talk focuses and Bob’s secret key.
This talk’s scope This talk’s recommendations Focus on private communications: The “asymmetric” part: ssh, email, purchasing, etc. Alice, Bob use Curve25519 to compute long-term shared secret Typical setup: from secret keys, public keys. Each communicating party Note: minimal asymmetric usage! has a long-term secret key and a long-term public key. The “symmetric” part: Alice, Bob use shared secret Alice authenticates and as key for Poly1305+Salsa20 encrypts messages to Bob to authenticate+encrypt packets. using Alice’s secret key and Bob’s public key. Curve25519 is the bottleneck Bob verifies and decrypts if there aren’t many packets. using Alice’s public key This talk focuses on Curve25519. and Bob’s secret key.
scope This talk’s recommendations Curve25519 secret Curve25519 public rivate communications: The “asymmetric” part: Time to compute purchasing, etc. Alice, Bob use Curve25519 to 957904 Pentium compute long-term shared secret 624786 Athlon cycles from secret keys, public keys. communicating party plus negligible hashing Note: minimal asymmetric usage! secret key No data-dependent public key. The “symmetric” part: No data-dependent Alice, Bob use shared secret authenticates and No known patent as key for Poly1305+Salsa20 messages to Bob Software is in public to authenticate+encrypt packets. secret key http://cr.yp.to/ecdh.html public key. Curve25519 is the bottleneck Best attack known and decrypts if there aren’t many packets. more expensive than public key This talk focuses on Curve25519. 128-bit brute-force secret key.
This talk’s recommendations Curve25519 secret key: 32 bytes. Curve25519 public key: 32 bytes. The “asymmetric” part: Time to compute shared secret: Alice, Bob use Curve25519 to 957904 Pentium 4 cycles or compute long-term shared secret 624786 Athlon cycles or : : : from secret keys, public keys. plus negligible hashing time. Note: minimal asymmetric usage! No data-dependent branches. The “symmetric” part: No data-dependent indexing. Alice, Bob use shared secret No known patent problems. as key for Poly1305+Salsa20 Software is in public domain. to authenticate+encrypt packets. http://cr.yp.to/ecdh.html Curve25519 is the bottleneck Best attack known is if there aren’t many packets. more expensive than typical This talk focuses on Curve25519. 128-bit brute-force search.
recommendations Curve25519 secret key: 32 bytes. Alice’s secret key Curve25519 public key: 32 bytes. integer a ; minor restrictions. “asymmetric” part: Time to compute shared secret: Curve25519 to Alice’s public key 957904 Pentium 4 cycles or power 9 a in Curve25519 long-term shared secret 624786 Athlon cycles or : : : eys, public keys. If Bob’s secret key plus negligible hashing time. asymmetric usage! Curve25519 uses No data-dependent branches. “symmetric” part: as f Alice ; Bob g ’s No data-dependent indexing. shared secret Bob computes sha No known patent problems. oly1305+Salsa20 with just one exp Software is in public domain. authenticate+encrypt packets. and one short hash. http://cr.yp.to/ecdh.html the bottleneck Best attack known is many packets. more expensive than typical cuses on Curve25519. 128-bit brute-force search.
Curve25519 secret key: 32 bytes. Alice’s secret key is Curve25519 public key: 32 bytes. integer a ; minor restrictions. Time to compute shared secret: Alice’s public key is 957904 Pentium 4 cycles or power 9 a in Curve25519 group. 624786 Athlon cycles or : : : If Bob’s secret key is b : plus negligible hashing time. Curve25519 uses hash of 9 ab No data-dependent branches. as f Alice ; Bob g ’s shared secret. No data-dependent indexing. Bob computes shared secret No known patent problems. with just one exponentiation Software is in public domain. and one short hash. http://cr.yp.to/ecdh.html Best attack known is more expensive than typical 128-bit brute-force search.
secret key: 32 bytes. Alice’s secret key is Exponentiation metho public key: 32 bytes. integer a ; minor restrictions. in the previous literature compute shared secret: take more than twice Alice’s public key is entium 4 cycles or at the Curve25519 power 9 a in Curve25519 group. cycles or : : : (Other secret-sha If Bob’s secret key is b : hashing time. even slower.) Curve25519 uses hash of 9 ab endent branches. Many interacting as f Alice ; Bob g ’s shared secret. endent indexing. in design and implementation. Bob computes shared secret patent problems. Hard to find optimal with just one exponentiation public domain. Remainder of this and one short hash. http://cr.yp.to/ecdh.html some of the choices known is in designing and than typical Curve25519. rute-force search.
Alice’s secret key is Exponentiation methods integer a ; minor restrictions. in the previous literature take more than twice as long Alice’s public key is at the Curve25519 security level. power 9 a in Curve25519 group. (Other secret-sharing methods: If Bob’s secret key is b : even slower.) Curve25519 uses hash of 9 ab Many interacting parameters as f Alice ; Bob g ’s shared secret. in design and implementation. Bob computes shared secret Hard to find optimal parameters. with just one exponentiation Remainder of this talk discusses and one short hash. some of the choices made in designing and implementing Curve25519.
Recommend
More recommend
