strongSwan

h1. Speed comparison of public key algorithms

h2. 32bit, native on a Core2Duo T9400 (one core)

h3. Diffie-Hellman Key Exchange

|_.DH group|_.Strength|_.Operations/s|_.gmp  |_.gcrypt |_.openssl |_.gmp*  |_.gcrypt*|_.openssl*|

|MODP 768  |>.62 bits |A=g^a mod p   |>.468.3|>.293.5  |>.371.9   |>.1271.8|>.866.0  |>.1060.6  |

|MODP 1024 |>.73 bits |A=g^a mod p   |>.216.6|>.136.4  |>.192.6   |>.792.7 |>.540.5  |>.706.1   |

|MODP 1536 |>.89 bits |A=g^a mod p   |>.71.5 |>.46.7   |>.70.8    |>.395.2 |>.279.2  |>.379.1   |

|MODP 2048 |>.103 bits|A=g^a mod p   |>.31.9 |>.20.9   |>.31.5    |>.161.7 |>.112.6  |>.155.0   |

|MODP 3072 |>.125 bits|A=g^a mod p   |>.10.2 |>.6.8    |>.11.2    |>.77.3  |>.55.9   |>.81.3    |

|MODP 4096 |>.142 bits|A=g^a mod p   |>.4.5  |>.3.0    |>.4.8     |>.34.4  |>.24.5   |>.35.7    |

|MODP 6144 |>.171 bits|A=g^a mod p   |>.1.5  |>.1.0    |>.1.6     |>.17.8  |>.11.9   |>.17.7    |

|MODP 8096 |>.193 bits|A=g^a mod p   |>.0.7  |>.0.4    |>.0.7     |>.11.2  |>.7.0    |>.10.2    |

|ECP 192   |>.96 bits |A=g^a mod p   |=._N/A_|=._N/A_  |>.961.6   |=.-     |=.-      |=.-       |

|ECP 224   |>.112 bits|A=g^a mod p   |=._N/A_|=._N/A_  |>.724.8   |=.-     |=.-      |=.-       |

|ECP 256   |>.128 bits|A=g^a mod p   |=._N/A_|=._N/A_  |>.577.7   |=.-     |=.-      |=.-       |

|ECP 384   |>.192 bits|A=g^a mod p   |=._N/A_|=._N/A_  |>.243.2   |=.-     |=.-      |=.-       |

|ECP 521   |>.260 bits|A=g^a mod p   |=._N/A_|=._N/A_  |>.117.2   |=.-     |=.-      |=.-       |

|MODP 768  |>.62 bits |S=B^a mod p   |>.489.3|>.205.7  |>.393.6   |>.1418.2|>.618.5  |>.1101.2  |

|MODP 1024 |>.73 bits |S=B^a mod p   |>.222.3|>.92.5   |>.195.4   |>.845.5 |>.372.9  |>.728.1   |

|MODP 1536 |>.89 bits |S=B^a mod p   |>.71.9 |>.31.4   |>.71.1    |>.409.7 |>.188.2  |>.382.7   |

|MODP 2048 |>.103 bits|S=B^a mod p   |>.31.9 |>.14.0   |>.31.6    |>.163.9 |>.74.5   |>.156.5   |

|MODP 3072 |>.125 bits|S=B^a mod p   |>.10.2 |>.4.6    |>.11.15   |>.77.8  |>.36.6   |>.80.6    |

|MODP 4096 |>.142 bits|S=B^a mod p   |>.4.5  |>.2.0    |>.4.8     |>.34.5  |>.16.2   |>.35.7    |

|MODP 6144 |>.171 bits|S=B^a mod p   |>.1.5  |>.0.7    |>.1.6     |>.17.8  |>.7.9    |>.17.6    |

|MODP 8096 |>.193 bits|S=B^a mod p   |>.0.6  |>.0.3    |>.0.7     |>.11.2  |>.4.5    |>.10.3    |

|ECP 192   |>.96 bits |S=B^a mod p   |=._N/A_|=._N/A_  |>.950.2   |=.-     |=.-      |=.-       |

|ECP 224   |>.112 bits|S=B^a mod p   |=._N/A_|=._N/A_  |>.716.9   |=.-     |=.-      |=.-       |

|ECP 256   |>.128 bits|S=B^a mod p   |=._N/A_|=._N/A_  |>.564.0   |=.-     |=.-      |=.-       |

|ECP 384   |>.192 bits|S=B^a mod p   |=._N/A_|=._N/A_  |>.239.1   |=.-     |=.-      |=.-       |

|ECP 521   |>.260 bits|S=B^a mod p   |=._N/A_|=._N/A_  |>.116.0   |=.-     |=.-      |=.-       |

_* = using reduced exponent size (libstrongswan.dh_exponent_ansi_x9_42 = no) as recommended by_ "RFC3526":http://tools.ietf.org/html/rfc3526#section-8

h2. 32bit, User-Mode-Linux on a Core2Duo T9400 (one core)

h3. Public Key Signature

|_.Key type|_.Strength*|_.Operations/s|_.gmp   |_.gcrypt |_.openssl |

|RSA 512   |>.50 bits  |sign          |>.3'791 |>.1'831  |>.2'105   |

|RSA 768   |>.62 bits  |sign          |>.1'519 |>.709    |>.810     |

|RSA 1024  |>.73 bits  |sign          |>.713   |>.292    |>.485     |

|RSA 1536  |>.89 bits  |sign          |>.240   |>.102    |>.184     |

|RSA 2048  |>.103 bits |sign          |>.110   |>.47     |>.93      |

|ECDSA 256 |>.128 bits |sign          |=._N/A_ |=._N/A_  |>.522     |

|ECDSA 384 |>.192 bits |sign          |=._N/A_ |=._N/A_  |>.226     |

|ECDSA 521 |>.260 bits |sign          |=._N/A_ |=._N/A_  |>.109     |

|RSA 512   |>.50 bits  |verify        |>.29'630|>.16'667 |>.25'806  |

|RSA 768   |>.62 bits  |verify        |>.18'182|>.10'714 |>.15'385  |

|RSA 1024  |>.73 bits  |verify        |>.11'765|>.6'897  |>.11'111  |

|RSA 1536  |>.89 bits  |verify        |>.5'882 |>.3'774  |>.5'882   |

|RSA 2048  |>.103 bits |verify        |>.3'571 |>.2'326  |>.3'704   |

|ECDSA 256 |>.128 bits |verify        |=._N/A_ |=._N/A_  |>.440     |

|ECDSA 384 |>.192 bits |verify        |=._N/A_ |=._N/A_  |>.180     |

|ECDSA 521 |>.260 bits |verify        |=._N/A_ |=._N/A_  |>.90      |

_* = cryptographic strength estimates according to_ "RFC 3766":http://tools.ietf.org/html/rfc3766 _using_ "www.keylength.com":http://www.keylength.com

h3. Diffie-Hellman Key Exchange

|_.DH group|_.Strength|_.Operations/s|_.gmp  |_.gcrypt |_.openssl |_.gmp*  |_.gcrypt*|_.openssl*|

|MODP 768  |>.62 bits |A=g^a mod p   |>.368  |>.243    |>.212     |>.741   |>.531    |>.319     |

|MODP 1024 |>.73 bits |A=g^a mod p   |>.196  |>.125    |>.136     |>.494   |>.388    |>.272     |

|MODP 1536 |>.89 bits |A=g^a mod p   |>.68   |>.45     |>.62      |>.308   |>.220    |>.196     |

|MODP 2048 |>.103 bits|A=g^a mod p   |>.31   |>.21     |>.28      |>.149   |>.98     |>.116     |

|ECP 192   |>.96 bits |A=g^a mod p   |=._N/A_|=._N/A_  |>.166     |=.-     |=.-      |=.-       |

|ECP 224   |>.112 bits|A=g^a mod p   |=._N/A_|=._N/A_  |>.157     |=.-     |=.-      |=.-       |

|ECP 256   |>.128 bits|A=g^a mod p   |=._N/A_|=._N/A_  |>.148     |=.-     |=.-      |=.-       |

|ECP 384   |>.192 bits|A=g^a mod p   |=._N/A_|=._N/A_  |>.91      |=.-     |=.-      |=.-       |

|ECP 521   |>.260 bits|A=g^a mod p   |=._N/A_|=._N/A_  |>.63      |=.-     |=.-      |=.-       |

|MODP 768  |>.62 bits |S=B^a mod p   |>.448  |>.190    |>.290     |>.1176  |>.496    |>.541     |

|MODP 1024 |>.73 bits |S=B^a mod p   |>.213  |>.89     |>.167     |>.727   |>.320    |>.440     |

|MODP 1536 |>.89 bits |S=B^a mod p   |>.71   |>.31     |>.64      |>.385   |>.175    |>.286     |

|MODP 2048 |>.103 bits|S=B^a mod p   |>.32   |>.13     |>.30      |>.164   |>.71     |>.141     |

|ECP 192   |>.96 bits |S=B^a mod p   |=._N/A_|=._N/A_  |>.171     |=.-     |=.-      |=.-       |

|ECP 224   |>.112 bits|S=B^a mod p   |=._N/A_|=._N/A_  |>.162     |=.-     |=.-      |=.-       |

|ECP 256   |>.128 bits|S=B^a mod p   |=._N/A_|=._N/A_  |>.152     |=.-     |=.-      |=.-       |

|ECP 384   |>.192 bits|S=B^a mod p   |=._N/A_|=._N/A_  |>.91      |=.-     |=.-      |=.-       |

|ECP 521   |>.260 bits|S=B^a mod p   |=._N/A_|=._N/A_  |>.65      |=.-     |=.-      |=.-       |

_* = using reduced exponent size (libstrongswan.dh_exponent_ansi_x9_42 = no) as recommended by_ "RFC3526":http://tools.ietf.org/html/rfc3526#section-8

h2. 64bit under VirtualBox, Core2Duo T9400 (one core):

h3. Public Key Signature

|_.Key type|_.Strength*|_.Operations/s|_.gmp    |_.gcrypt |_.openssl |

|RSA 512   |>.50 bits  |sign          |>.13'082 |>.3'530  |>.7'478   |

|RSA 768   |>.62 bits  |sign          |>.5'523  |>.1'603  |>.3'154   |

|RSA 1024  |>.73 bits  |sign          |>.2'742  |>.766    |>.1'577   |

|RSA 1536  |>.89 bits  |sign          |>.937    |>.285    |>.555     |

|RSA 2048  |>.103 bits |sign          |>.433    |>.133    |>.258     |

|ECDSA 256 |>.128 bits |sign          |=._N/A_  |=._N/A_  |>.1'267   |

|ECDSA 384 |>.192 bits |sign          |=._N/A_  |=._N/A_  |>.577     |

|ECDSA 521 |>.260 bits |sign          |=._N/A_  |=._N/A_  |>.291     |

|RSA 512   |>.50 bits  |verify        |>.103'733|>.36'197 |>.59'598  |

|RSA 768   |>.62 bits  |verify        |>.61'520 |>.25'411 |>.35'704  |

|RSA 1024  |>.73 bits  |verify        |>.41'377 |>.16'098 |>.26'314  |

|RSA 1536  |>.89 bits  |verify        |>.22'148 |>.10'941 |>.13'607  |

|RSA 2048  |>.103 bits |verify        |>.13'500 |>.6'524  |>.8'345   |

|ECDSA 256 |>.128 bits |verify        |=._N/A_  |=._N/A_  |>.1'143   |

|ECDSA 384 |>.192 bits |verify        |=._N/A_  |=._N/A_  |>.508     |

|ECDSA 512 |>.260 bits |verify        |=._N/A_  |=._N/A_  |>.255     |

_* = cryptographic strength estimates according to_ "RFC 3766":http://tools.ietf.org/html/rfc3766 _using_ "www.keylength.com":http://www.keylength.com

h3. Diffie-Hellman Key Exchange

|_.DH group|_.Strength|_.Operations/s|_.gmp   |_.gcrypt |_.openssl |_.gmp*  |_.gcrypt*|_.openssl*|

|MODP 768  |>.62 bits |A=g^a mod p   |>.1'853 |>.790    |>.1'088   |>.5'622 |>.2'151  |>.2'656   |

|MODP 1024 |>.73 bits |A=g^a mod p   |>.862   |>.347    |>.491     |>.3'523 |>.1'352  |>.1'689   |

|MODP 1536 |>.89 bits |A=g^a mod p   |>.269   |>.135    |>.168     |>.1'612 |>.776    |>.837     |

|MODP 2048 |>.103 bits|A=g^a mod p   |>.117   |>.55     |>.73      |>.689   |>.298    |>.362     |

|ECP 192   |>.96 bits |A=g^a mod p   |=._N/A_ |=._N/A_  |>.1'699   |=.-     |=.-      |=.-       |

|ECP 224   |>.112 bits|A=g^a mod p   |=._N/A_ |=._N/A_  |>.1'494   |=.-     |=.-      |=.-       |

|ECP 256   |>.128 bits|A=g^a mod p   |=._N/A_ |=._N/A_  |>.1'298   |=.-     |=.-      |=.-       |

|ECP 384   |>.192 bits|A=g^a mod p   |=._N/A_ |=._N/A_  |>.591     |=.-     |=.-      |=.-       |

|ECP 521   |>.260 bits |A=g^a mod p   |=._N/A_ |=._N/A_  |>.306     |=.-     |=.-      |=.-       |

|MODP 768  |>.62 bits |S=B^a mod p   |>.1'882 |>.595    |>.1'191   |>.5'737 |>.1'779  |>.3'280   |

|MODP 1024 |>.73 bits |S=B^a mod p   |>.869   |>.274    |>.535     |>.3'431 |>.1'035  |>.1'928   |

|MODP 1536 |>.89 bits |S=B^a mod p   |>.278   |>.98     |>.174     |>.1'648 |>.571    |>.900     |

|MODP 2048 |>.103 bits|S=B^a mod p   |>.122   |>.38     |>.74      |>.660   |>.214    |>.380     |

|ECP 192   |>.96 bits |S=B^a mod p   |=._N/A_ |=._N/A_  |>.1'727   |=.-     |=.-      |=.-       |

|ECP 224   |>.112 bits|S=B^a mod p   |=._N/A_ |=._N/A_  |>.1'589   |=.-     |=.-      |=.-       |

|ECP 256   |>.128 bits|S=B^a mod p   |=._N/A_ |=._N/A_  |>.1'423   |=.-     |=.-      |=.-       |

|ECP 384   |>.192 bits|S=B^a mod p   |=._N/A_ |=._N/A_  |>.609     |=.-     |=.-      |=.-       |

|ECP 521   |>.260 bits |S=B^a mod p   |=._N/A_ |=._N/A_  |>.313     |=.-     |=.-      |=.-       |

_* = using reduced exponent size (libstrongswan.dh_exponent_ansi_x9_42 = no) as recommended by_ "RFC3526":http://tools.ietf.org/html/rfc3526#section-8