strongSwan

h1. Speed comparison of public key algorithms

h2. 32bit, native on a Core2Duo T9400 (one core)

h3. Public Key Signature

|_.Key type|_.Strength*|_.Operations/s|_.gmp   |_.gcrypt|_.openssl|

|RSA 512   |>.50 bits  |sign (e=3)    |>.3'708 |>.1'814 |>.2'286  |

|RSA 512   |>.50 bits  |sign (e=f4)   |>.3'946 |>.1'780 |>.2'150  |

|RSA 768   |>.62 bits  |sign (e=3)    |>.1'483 |>.625   |>.521    |

|RSA 768   |>.62 bits  |sign (e=f4)   |>.1'486 |>.626   |>.783    |

|RSA 1024  |>.73 bits  |sign (e=3)    |>.724   |>.301   |>.488    |

|RSA 1024  |>.73 bits  |sign (e=f4)   |>.722   |>.285   |>.475    |

|RSA 1536  |>.89 bits  |sign (e=3)    |>.242   |>.99    |>.117    |

|RSA 1536  |>.89 bits  |sign (e=f4)   |>.243   |>.98    |>.111    |

|RSA 2048  |>.103 bits |sign (e=3)    |>.110   |>.30    |>.80     |

|RSA 2048  |>.103 bits |sign (e=f4)   |>.109   |>.28    |>.89     |

|RSA 3072  |>.125 bits |sign (e=3)    |>.35    |>.9     |>.33     |

|RSA 3072  |>.125 bits |sign (e=f4)   |>.35    |>.15    |>.32     |

|RSA 4096  |>.142 bits |sign (e=3)    |>.15    |>.6     |>.9      |

|RSA 4096  |>.142 bits |sign (e=f4)   |>.15    |>.6     |>.9      |

|RSA 6144  |>.171 bits |sign (e=3)    |>.4     |>.2     |>.3      |

|RSA 6144  |>.171 bits |sign (e=f4)   |>.4     |>.2     |>.3      |

|RSA 8192  |>.193 bits |sign (e=3 )   |>.2     |>.1     |>.2      |

|RSA 8192  |>.193 bits |sign (e=f4)   |>.2     |>.1     |>.1      |

|ECDSA 256 |>.128 bits |sign          |=._N/A_ |=._N/A_ |>.546    |

|ECDSA 384 |>.192 bits |sign          |=._N/A_ |=._N/A_ |>.233    |

|ECDSA 521 |>.260 bits |sign          |=._N/A_ |=._N/A_ |>.113    |

|RSA 512   |>.50 bits  |verify (e=3)  |>.76'683|>.36'626|>.55'685 |

|RSA 512   |>.50 bits  |verify (e=f4) |>.32'577|>.15'860|>.25'086 |

|RSA 768   |>.62 bits  |verify (e=3)  |>.52'707|>.31'167|>.37'112 |

|RSA 768   |>.62 bits  |verify (e=f4) |>.17'375|>.10'054|>.15'034 |

|RSA 1024  |>.73 bits  |verify (e=3)  |>.37'826|>.25'688|>.28'879 |

|RSA 1024  |>.73 bits  |verify (e=f4) |>.11'402|>.6'640 |>.10'380 |

|RSA 1536  |>.89 bits  |verify (e=3)  |>.22'143|>.18'505|>.10'393 |

|RSA 1536  |>.89 bits  |verify (e=f4) |>.5'892 |>.3'770 |>.3'686  |

|RSA 2048  |>.103 bits |verify (e=3)  |>.14'175|>.8'307 |>.11'625 |

|RSA 2048  |>.103 bits |verify (e=f4) |>.3'481 |>.1'423 |>.3'535  |

|RSA 3072  |>.125 bits |verify (e=3)  |>.7'207 |>.4'930 |>.5'654  |

|RSA 3072  |>.125 bits |verify (e=f4) |>.1'729 |>.1'150 |>.1'857  |

|RSA 4096  |>.142 bits |verify (e=3)  |>.5'887 |>.4'960 |>.2'263  |

|RSA 4096  |>.142 bits |verify (e=f4) |>.1'049 |>.684   |>.672    |

|RSA 6144  |>.171 bits |verify (e=3)  |>.3'171 |>.2630  |>.977    |

|RSA 6144  |>.171 bits |verify (e=f4) |>.544   |>.335   |>.324    |

|RSA 8192  |>.193 bits |verify (e=3)  |>.2'015 |>.1638  |>.839    |

|RSA 8192  |>.193 bits |verify (e=f4) |>.334   |>.194   |>.181    |

|ECDSA 256 |>.128 bits |verify        |=._N/A_ |=._N/A_ |>.459    |

|ECDSA 384 |>.192 bits |verify        |=._N/A_ |=._N/A_ |>.196    |

|ECDSA 521 |>.260 bits |verify        |=._N/A_ |=._N/A_ |>.94     |

_* = cryptographic strength estimates according to_ "RFC 3766":http://tools.ietf.org/html/rfc3766 _using_ "www.keylength.com":http://www.keylength.com

h3. Diffie-Hellman Key Exchange

|_.DH group|_.Strength|_.Operations/s|_.gmp  |_.gcrypt|_.openssl |_.gmp* |_.gcrypt*|_.openssl*|

|MODP 768  |>.62 bits |A=g^a mod p   |>.468  |>.293   |>.371     |>.1'271|>.866    |>.1'060   |

|MODP 1024 |>.73 bits |A=g^a mod p   |>.216  |>.136   |>.192     |>.792  |>.540    |>.706     |

|MODP 1536 |>.89 bits |A=g^a mod p   |>.71   |>.46    |>.70      |>.395  |>.279    |>.379     |

|MODP 2048 |>.103 bits|A=g^a mod p   |>.31   |>.20    |>.31      |>.161  |>.112    |>.155     |

|MODP 3072 |>.125 bits|A=g^a mod p   |>.10   |>.6     |>.11      |>.77   |>.55     |>.81      |

|MODP 4096 |>.142 bits|A=g^a mod p   |>.4    |>.3     |>.4       |>.34   |>.24     |>.35      |

|MODP 6144 |>.171 bits|A=g^a mod p   |>.1    |>.1     |>.1       |>.17   |>.11     |>.17      |

|MODP 8096 |>.193 bits|A=g^a mod p   |>.1    |>.1     |>.0       |>.11   |>.7      |>.10      |

|ECP 192   |>.96 bits |A=g^a mod p   |=._N/A_|=._N/A_ |>.961     |=.-    |=.-      |=.-       |

|ECP 224   |>.112 bits|A=g^a mod p   |=._N/A_|=._N/A_ |>.724     |=.-    |=.-      |=.-       |

|ECP 256   |>.128 bits|A=g^a mod p   |=._N/A_|=._N/A_ |>.577     |=.-    |=.-      |=.-       |

|ECP 384   |>.192 bits|A=g^a mod p   |=._N/A_|=._N/A_ |>.243     |=.-    |=.-      |=.-       |

|ECP 521   |>.260 bits|A=g^a mod p   |=._N/A_|=._N/A_ |>.117     |=.-    |=.-      |=.-       |

|MODP 768  |>.62 bits |S=B^a mod p   |>.489  |>.205   |>.393     |>.1'418|>.618    |>.1'101   |

|MODP 1024 |>.73 bits |S=B^a mod p   |>.222  |>.92    |>.195     |>.845  |>.372    |>.728     |

|MODP 1536 |>.89 bits |S=B^a mod p   |>.71   |>.31    |>.71      |>.409  |>.188    |>.382     |

|MODP 2048 |>.103 bits|S=B^a mod p   |>.31   |>.14    |>.31      |>.163  |>.74     |>.156     |

|MODP 3072 |>.125 bits|S=B^a mod p   |>.10   |>.4     |>.11      |>.77   |>.36     |>.80      |

|MODP 4096 |>.142 bits|S=B^a mod p   |>.4    |>.2     |>.4       |>.34   |>.16     |>.35      |

|MODP 6144 |>.171 bits|S=B^a mod p   |>.1    |>.0     |>.1       |>.17   |>.7      |>.17      |

|MODP 8096 |>.193 bits|S=B^a mod p   |>.1    |>.0     |>.1       |>.11   |>.4      |>.10      |

|ECP 192   |>.96 bits |S=B^a mod p   |=._N/A_|=._N/A_ |>.950     |=.-    |=.-      |=.-       |

|ECP 224   |>.112 bits|S=B^a mod p   |=._N/A_|=._N/A_ |>.716     |=.-    |=.-      |=.-       |

|ECP 256   |>.128 bits|S=B^a mod p   |=._N/A_|=._N/A_ |>.564     |=.-    |=.-      |=.-       |

|ECP 384   |>.192 bits|S=B^a mod p   |=._N/A_|=._N/A_ |>.239     |=.-    |=.-      |=.-       |

|ECP 521   |>.260 bits|S=B^a mod p   |=._N/A_|=._N/A_ |>.116     |=.-    |=.-      |=.-       |

_* = using reduced exponent size (libstrongswan.dh_exponent_ansi_x9_42 = no) as recommended by_ "RFC3526":http://tools.ietf.org/html/rfc3526#section-8

h2. 64bit under VirtualBox, Core2Duo T9400 (one core):

h3. Public Key Signature

|_.Key type|_.Strength*|_.Operations/s|_.gmp    |_.gcrypt |_.openssl |

|RSA 512   |>.50 bits  |sign          |>.13'082 |>.3'530  |>.7'478   |

|RSA 768   |>.62 bits  |sign          |>.5'523  |>.1'603  |>.3'154   |

|RSA 1024  |>.73 bits  |sign          |>.2'742  |>.766    |>.1'577   |

|RSA 1536  |>.89 bits  |sign          |>.937    |>.285    |>.555     |

|RSA 2048  |>.103 bits |sign          |>.433    |>.133    |>.258     |

|ECDSA 256 |>.128 bits |sign          |=._N/A_  |=._N/A_  |>.1'267   |

|ECDSA 384 |>.192 bits |sign          |=._N/A_  |=._N/A_  |>.577     |

|ECDSA 521 |>.260 bits |sign          |=._N/A_  |=._N/A_  |>.291     |

|RSA 512   |>.50 bits  |verify        |>.103'733|>.36'197 |>.59'598  |

|RSA 768   |>.62 bits  |verify        |>.61'520 |>.25'411 |>.35'704  |

|RSA 1024  |>.73 bits  |verify        |>.41'377 |>.16'098 |>.26'314  |

|RSA 1536  |>.89 bits  |verify        |>.22'148 |>.10'941 |>.13'607  |

|RSA 2048  |>.103 bits |verify        |>.13'500 |>.6'524  |>.8'345   |

|ECDSA 256 |>.128 bits |verify        |=._N/A_  |=._N/A_  |>.1'143   |

|ECDSA 384 |>.192 bits |verify        |=._N/A_  |=._N/A_  |>.508     |

|ECDSA 512 |>.260 bits |verify        |=._N/A_  |=._N/A_  |>.255     |

_* = cryptographic strength estimates according to_ "RFC 3766":http://tools.ietf.org/html/rfc3766 _using_ "www.keylength.com":http://www.keylength.com

h3. Diffie-Hellman Key Exchange

|_.DH group|_.Strength|_.Operations/s|_.gmp   |_.gcrypt |_.openssl |_.gmp*  |_.gcrypt*|_.openssl*|

|MODP 768  |>.62 bits |A=g^a mod p   |>.1'853 |>.790    |>.1'088   |>.5'622 |>.2'151  |>.2'656   |

|MODP 1024 |>.73 bits |A=g^a mod p   |>.862   |>.347    |>.491     |>.3'523 |>.1'352  |>.1'689   |

|MODP 1536 |>.89 bits |A=g^a mod p   |>.269   |>.135    |>.168     |>.1'612 |>.776    |>.837     |

|MODP 2048 |>.103 bits|A=g^a mod p   |>.117   |>.55     |>.73      |>.689   |>.298    |>.362     |

|ECP 192   |>.96 bits |A=g^a mod p   |=._N/A_ |=._N/A_  |>.1'699   |=.-     |=.-      |=.-       |

|ECP 224   |>.112 bits|A=g^a mod p   |=._N/A_ |=._N/A_  |>.1'494   |=.-     |=.-      |=.-       |

|ECP 256   |>.128 bits|A=g^a mod p   |=._N/A_ |=._N/A_  |>.1'298   |=.-     |=.-      |=.-       |

|ECP 384   |>.192 bits|A=g^a mod p   |=._N/A_ |=._N/A_  |>.591     |=.-     |=.-      |=.-       |

|ECP 521   |>.260 bits |A=g^a mod p   |=._N/A_ |=._N/A_  |>.306     |=.-     |=.-      |=.-       |

|MODP 768  |>.62 bits |S=B^a mod p   |>.1'882 |>.595    |>.1'191   |>.5'737 |>.1'779  |>.3'280   |

|MODP 1024 |>.73 bits |S=B^a mod p   |>.869   |>.274    |>.535     |>.3'431 |>.1'035  |>.1'928   |

|MODP 1536 |>.89 bits |S=B^a mod p   |>.278   |>.98     |>.174     |>.1'648 |>.571    |>.900     |

|MODP 2048 |>.103 bits|S=B^a mod p   |>.122   |>.38     |>.74      |>.660   |>.214    |>.380     |

|ECP 192   |>.96 bits |S=B^a mod p   |=._N/A_ |=._N/A_  |>.1'727   |=.-     |=.-      |=.-       |

|ECP 224   |>.112 bits|S=B^a mod p   |=._N/A_ |=._N/A_  |>.1'589   |=.-     |=.-      |=.-       |

|ECP 256   |>.128 bits|S=B^a mod p   |=._N/A_ |=._N/A_  |>.1'423   |=.-     |=.-      |=.-       |

|ECP 384   |>.192 bits|S=B^a mod p   |=._N/A_ |=._N/A_  |>.609     |=.-     |=.-      |=.-       |

|ECP 521   |>.260 bits |S=B^a mod p   |=._N/A_ |=._N/A_  |>.313     |=.-     |=.-      |=.-       |

_* = using reduced exponent size (libstrongswan.dh_exponent_ansi_x9_42 = no) as recommended by_ "RFC3526":http://tools.ietf.org/html/rfc3526#section-8