strongSwan

h1. Speed Comparison of Public Key Algorithms

{{>toc}}

h2. 32 bit, native on a Core2Duo T9400 (one core)

h3. Public Key Signature - Generation

|_.Key type   |_.Strength*   |_.Operations/s|_.gmp   |_.gcrypt|_.openssl|

|/2.RSA 512   |/2>.50 bits   |sign (e=3)    |>.3'708 |>.1'814 |>.2'286  |

                             |sign (e=f4)   |>.3'946 |>.1'780 |>.2'150  |

|/2.RSA 768   |/2>.62 bits   |sign (e=3)    |>.1'483 |>.625   |>.521    |

                             |sign (e=f4)   |>.1'486 |>.626   |>.783    |

|/2.RSA 1024  |/2>.73 bits   |sign (e=3)    |>.724   |>.301   |>.488    |

                             |sign (e=f4)   |>.722   |>.285   |>.475    |

|/2.RSA 1536  |/2>.89 bits   |sign (e=3)    |>.242   |>.99    |>.117    |

                             |sign (e=f4)   |>.243   |>.98    |>.111    |

|/2.RSA 2048  |/2>.103 bits  |sign (e=3)    |>.110   |>.30    |>.80     |

                             |sign (e=f4)   |>.109   |>.28    |>.89     |

|/2.*RSA 3072*|/2>.*125 bits*|*sign (e=3)*  |>.*35*  |>.*9*   |>.*33*   |

                             |*sign (e=f4)* |>.*35*  |>.*15*  |>.*32*   |

|/2.RSA 4096  |/2>.142 bits  |sign (e=3)    |>.15    |>.6     |>.9      |

                             |sign (e=f4)   |>.15    |>.6     |>.9      |

|/2.RSA 6144  |/2>.171 bits  |sign (e=3)    |>.4     |>.2     |>.3      |

                             |sign (e=f4)   |>.4     |>.2     |>.3      |

|/2.RSA 8192  |/2>.193 bits  |sign (e=3 )   |>.2     |>.1     |>.2      |

                             |sign (e=f4)   |>.2     |>.1     |>.1      |

|*ECDSA 256*  |>.*128 bits*  |*sign*        |=._N/A_ |=._N/A_ |>.*546*  |

|ECDSA 384    |>.192 bits    |sign          |=._N/A_ |=._N/A_ |>.233    |

|ECDSA 521    |>.260 bits    |sign          |=._N/A_ |=._N/A_ |>.113    |

_* = cryptographic strength estimates according to_ "RFC 3766":http://tools.ietf.org/html/rfc3766 _using_ "www.keylength.com":http://www.keylength.com

h3. Public Key Signature - Verification

|_.Key type   |_.Strength    |_.Operations/s |_.gmp    |_.gcrypt |_.openssl|

|/2.RSA 512   |/2>.50 bits   |verify (e=3)   |>.76'683 |>.36'626 |>.55'685 |

                             |verify (e=f4)  |>.32'577 |>.15'860 |>.25'086 |

|/2.RSA 768   |/2>.62 bits   |verify (e=3)   |>.52'707 |>.31'167 |>.37'112 |

                             |verify (e=f4)  |>.17'375 |>.10'054 |>.15'034 |

|/2.RSA 1024  |/2>.73 bits   |verify (e=3)   |>.37'826 |>.25'688 |>.28'879 |

                             |verify (e=f4)  |>.11'402 |>.6'640  |>.10'380 |

|/2.RSA 1536  |/2>.89 bits   |verify (e=3)   |>.22'143 |>.18'505 |>.10'393 |

                             |verify (e=f4)  |>.5'892  |>.3'770  |>.3'686  |

|/2.RSA 2048  |/2>.103 bits  |verify (e=3)   |>.14'175 |>.8'307  |>.11'625 |

                             |verify (e=f4)  |>.3'481  |>.1'423  |>.3'535  |

|/2.*RSA 3072*|/2>.*125 bits*|*verify (e=3)* |>.*7'207*|>.*4'930*|>.*5'654*|

                             |*verify (e=f4)*|>.*1'729*|>.*1'150*|>.*1'857*|

|/2.RSA 4096  |/2>.142 bits  |verify (e=3)   |>.5'887  |>.4'960  |>.2'263  |

                             |verify (e=f4)  |>.1'049  |>.684    |>.672    |

|/2.RSA 6144  |/2>.171 bits  |verify (e=3)   |>.3'171  |>.2630   |>.977    |

                             |verify (e=f4)  |>.544    |>.335    |>.324    |

|/2.RSA 8192  |/2>.193 bits  |verify (e=3)   |>.2'015  |>.1638   |>.839    |

                             |verify (e=f4)  |>.334    |>.194    |>.181    |

|*ECDSA 256*  |>.*128 bits*  |*verify*       |=._N/A_  |=._N/A_  |>.*459*  |

|ECDSA 384    |>.192 bits    |verify         |=._N/A_  |=._N/A_  |>.196    |

|ECDSA 521    |>.260 bits    |verify         |=._N/A_  |=._N/A_  |>.94     |

h3. Diffie-Hellman Key Exchange

|_.DH group    |_.Strength    |_.Operations/s|_.gmp  |_.gcrypt|_.openssl |_.gmp* |_.gcrypt*|_.openssl*|

|/2.MODP 768   |/2>.62 bits   |A=g^a mod p   |>.468  |>.293   |>.371     |>.1'271|>.866    |>.1'060   |

                              |S=B^a mod p   |>.489  |>.205   |>.393     |>.1'418|>.618    |>.1'101   |

|/2.MODP 1024  |/2>.73 bits   |A=g^a mod p   |>.216  |>.136   |>.192     |>.792  |>.540    |>.706     |

                              |S=B^a mod p   |>.222  |>.92    |>.195     |>.845  |>.372    |>.728     |

|/2.MODP 1536  |/2>.89 bits   |A=g^a mod p   |>.71   |>.46    |>.70      |>.395  |>.279    |>.379     |

                              |S=B^a mod p   |>.71   |>.31    |>.71      |>.409  |>.188    |>.382     |

|/2.MODP 2048  |/2>.103 bits  |A=g^a mod p   |>.31   |>.20    |>.31      |>.161  |>.112    |>.155     |

                              |S=B^a mod p   |>.31   |>.14    |>.31      |>.163  |>.74     |>.156     |

|/2.*MODP 3072*|/2>.*125 bits*|*A=g^a mod p* |>.*10* |>.*6*   |>.*11*    |>.*77* |>.*55*   |>.*81*    |

                              |*S=B^a mod p* |>.*10* |>.*4*   |>.*11*    |>.*77* |>.*36*   |>.*80*    |

|/2.MODP 4096  |/2>.142 bits  |A=g^a mod p   |>.4    |>.3     |>.4       |>.34   |>.24     |>.35      |

                              |S=B^a mod p   |>.4    |>.2     |>.4       |>.34   |>.16     |>.35      |

|/2.MODP 6144  |/2>.171 bits  |A=g^a mod p   |>.1    |>.1     |>.1       |>.17   |>.11     |>.17      |

                              |S=B^a mod p   |>.1    |>.0     |>.1       |>.17   |>.7      |>.17      |

|/2.MODP 8096  |/2>.193 bits  |A=g^a mod p   |>.1    |>.1     |>.0       |>.11   |>.7      |>.10      |

                              |S=B^a mod p   |>.1    |>.0     |>.1       |>.11   |>.4      |>.10      |

|/2.ECP 192    |/2>.96 bits   |A=g^a mod p   |=._N/A_|=._N/A_ |>.961     |\3/10=.-|

                              |S=B^a mod p   |=._N/A_|=._N/A_ |>.950     |

|/2.ECP 224    |/2>.112 bits  |A=g^a mod p   |=._N/A_|=._N/A_ |>.724     |

                              |S=B^a mod p   |=._N/A_|=._N/A_ |>.716     |

|/2.*ECP 256*  |/2>.*128 bits*|*A=g^a mod p* |=._N/A_|=._N/A_ |>.*577*   |

                              |*S=B^a mod p* |=._N/A_|=._N/A_ |>.*564*   |

|/2.ECP 384    |/2>.192 bits  |A=g^a mod p   |=._N/A_|=._N/A_ |>.243     |

                              |S=B^a mod p   |=._N/A_|=._N/A_ |>.239     |

|/2.ECP 521    |/2>.260 bits  |A=g^a mod p   |=._N/A_|=._N/A_ |>.117     |

                              |S=B^a mod p   |=._N/A_|=._N/A_ |>.116     |

_* = using reduced exponent size (libstrongswan.dh_exponent_ansi_x9_42 = no) as recommended by_ "RFC3526":http://tools.ietf.org/html/rfc3526#section-8

h2. 64 bit, under VirtualBox, Core2Duo T9400 (one core):

h3. Public Key Signature - Generation

|_.Key type   |_.Strength*   |_.Operations/s|_.gmp    |_.gcrypt|_.openssl|

|/2.RSA 512   |/2>.50 bits   |sign (e=3)    |>.12'715 |>.3474  |>.7'405  |

                             |sign (e=f4)   |>.12'453 |>.3463  |>.4'471  |

|/2.RSA 768   |/2>.62 bits   |sign (e=3)    |>.5'414  |>.1234  |>.2'371  |

                             |sign (e=f4)   |>.5'617  |>.1142  |>.2'974  |

|/2.RSA 1024  |/2>.73 bits   |sign (e=3)    |>.2'756  |>.769   |>.1'565  |

                             |sign (e=f4)   |>.2'765  |>.516   |>.1'523  |

|/2.RSA 1536  |/2>.89 bits   |sign (e=3)    |>.980    |>.181   |>.548    |

                             |sign (e=f4)   |>.978    |>.279   |>.525    |

|/2.RSA 2048  |/2>.103 bits  |sign (e=3)    |>.447    |>.126   |>.160    |

                             |sign (e=f4)   |>.453    |>.122   |>.147    |

|/2.*RSA 3072*|/2>.*125 bits*|*sign (e=3)*  |>.*140*  |>.*45*  |>.*51*   |

                             |*sign (e=f4)* |>.*146*  |>.*44*  |>.*46*   |

|/2.RSA 4096  |/2>.142 bits  |sign (e=3)    |>.71     |>.19    |>.36     |

                             |sign (e=f4)   |>.62     |>.11    |>.34     |

|/2.RSA 6144  |/2>.171 bits  |sign (e=3)    |>.19     |>.7     |>.11     |

                             |sign (e=f4)   |>.20     |>.6     |>.10     |

|/2.RSA 8192  |/2>.193 bits  |sign (e=3)    |>.7      |>.3     |>.4      |

                             |sign (e=f4)   |>.8      |>.3     |>.4      |

|*ECDSA 256*  |>.*128 bits*  |*sign*        |=._N/A_  |=._N/A_ |>.*1'204*|

|ECDSA 384    |>.192 bits    |sign          |=._N/A_  |=._N/A_ |>.551    |

|ECDSA 521    |>.260 bits    |sign          |=._N/A_  |=._N/A_ |>.280    |

_* = cryptographic strength estimates according to_ "RFC 3766":http://tools.ietf.org/html/rfc3766 _using_ "www.keylength.com":http://www.keylength.com

h3. Public Key Signature - Verification

|_.Key type   |_.Strength    |_.Operations/s |_.gmp     |_.gcrypt  |_.openssl |

|/2.RSA 512   |/2>.50 bits   |verify (e=3)   |>.131'663 |>.50'944  |>.86'962  |

                             |verify (e=f4)  |>.85'975  |>.25'927  |>.34'702  |

|/2.RSA 768   |/2>.62 bits   |verify (e=3)   |>.114'546 |>.47'151  |>.67'016  |

                             |verify (e=f4)  |>.51'425  |>.23'467  |>.36'163  |

|/2.RSA 1024  |/2>.73 bits   |verify (e=3)   |>.89'899  |>.41'223  |>.57'059  |

                             |verify (e=f4)  |>.40'736  |>.9'569   |>.26'082  |

|/2.RSA 1536  |/2>.89 bits   |verify (e=3)   |>.59'941  |>.33'632  |>.33'338  |

                             |verify (e=f4)  |>.20'979  |>.9'520   |>.12'731  |

|/2.RSA 2048  |/2>.103 bits  |verify (e=3)   |>.35'728  |>.22'385  |>.16'076  |

                             |verify (e=f4)  |>.12'313  |>.5'140   |>.4'630   |

|/2.*RSA 3072*|/2>.*125 bits*|*verify (e=3)* |>.*16'474*|>.*21'272*|>.*12'929*|

                             |*verify (e=f4)*|>.*6'318* |>.*3'377* |>.*2'305* |

|/2.RSA 4096  |/2>.142 bits  |verify (e=3)   |>.9'081  |>.4'894    |>.4'643   |

                             |verify (e=f4)  |>.2'975  |>.919      |>.2'128   |

|/2.RSA 6144  |/2>.171 bits  |verify (e=3)   |>.3'758  |>.6'793    |>.2'666   |

                             |verify (e=f4)  |>.1'540  |>.1'047    |>.894     |

|/2.RSA 8192  |/2>.193 bits  |verify (e=3)   |>.3'039  |>.3'871    |>.1'204   |

                             |verify (e=f4)  |>.1'643  |>.579      |>.462     |

|*ECDSA 256*  |>.*128 bits*  |*verify*       |=._N/A_  |=._N/A_    |>.*1'098* |

|ECDSA 384    |>.192 bits    |verify         |=._N/A_  |=._N/A_    |>.484     |

|ECDSA 521    |>.260 bits    |verify         |=._N/A_  |=._N/A_    |>.239     |

h3. Diffie-Hellman Key Exchange

|_.DH group    |_.Strength    |_.Operations/s|_.gmp  |_.gcrypt|_.openssl|_.gmp* |_.gcrypt*|_.openssl*|

|/2.MODP 768   |/2>.62 bits   |A=g^a mod p   |>.1'631|>.756   |>.1'040  |>.3'847|>.2'121  |>.2'786   |

                              |S=B^a mod p   |>.1'931|>.565   |>.1'119  |>.5'474|>.1792   |>.3'300   |

|/2.MODP 1024  |/2>.73 bits   |A=g^a mod p   |>.805  |>.342   |>.484    |>.2'722|>.1'381  |>.1'764   |

                              |S=B^a mod p   |>.866  |>.232   |>.382    |>.3'271|>.1037   |>.1'993   |

|/2.MODP 1536  |/2>.89 bits   |A=g^a mod p   |>.268  |>.130   |>.99     |>.1'340|>.783    |>.873     |

                              |S=B^a mod p   |>.279  |>.88    |>.135    |>.1'590|>.574    |>.920     |

|/2.MODP 2048  |/2>.103 bits  |A=g^a mod p   |>.121  |>.56    |>.70     |>.592  |>.320    |>.343     |

                              |S=B^a mod p   |>.123  |>.38    |>.50     |>.634  |>.216    |>.366     |

|/2.*MODP 3072*|/2>.*125 bits*|*A=g^a mod p* |>.*38* |>.*20*  |>.*21*   |>.*282*|>.*172*  |>.*159*   |

                              |*S=B^a mod p* |>.*38* |>.*13*  |>.*14*   |>.*289*|>.*118*  |>.*165*   |

|/2.MODP 4096  |/2>.142 bits  |A=g^a mod p   |>.16   |>.6     |>.8      |>.125  |>.75     |>.70      |

                              |S=B^a mod p   |>.16   |>.4     |>.9      |>.126  |>.49     |>.67      |

|/2.MODP 6144  |/2>.171 bits  |A=g^a mod p   |>.5    |>.2     |>.3      |>.59   |>.38     |>.31      |

                              |S=B^a mod p   |>.5    |>.1     |>.1      |>.61   |>.25     |>.31      |

|/2.MODP 8096  |/2>.193 bits  |A=g^a mod p   |>.2    |>.1     |>.0      |>.34   |>.22     |>.17      |

                              |S=B^a mod p   |>.2    |>.0     |>.1      |>.39   |>.14     |>.18      |

|/2.ECP 192    |/2>.96 bits   |A=g^a mod p   |=._N/A_|=._N/A_ |>.988    |\3/10=.-|

                              |S=B^a mod p   |=._N/A_|=._N/A_ |>.1'058  |

|/2.ECP 224    |/2>.112 bits  |A=g^a mod p   |=._N/A_|=._N/A_ |>.873    |

                              |S=B^a mod p   |=._N/A_|=._N/A_ |>.963    |

|/2.*ECP 256*  |/2>.*128 bits*|*A=g^a mod p* |=._N/A_|=._N/A_ |>.*823*  |

                              |*S=B^a mod p* |=._N/A_|=._N/A_ |>.*851*|

|/2.ECP 384    |/2>.192 bits  |A=g^a mod p   |=._N/A_|=._N/A_ |>.360    |

                              |S=B^a mod p   |=._N/A_|=._N/A_ |>.364    |

|/2.ECP 521    |/2>.260 bits  |A=g^a mod p   |=._N/A_|=._N/A_ |>.180    |

                              |S=B^a mod p   |=._N/A_|=._N/A_ |>.210    |

_* = using reduced exponent size (libstrongswan.dh_exponent_ansi_x9_42 = no) as recommended by_ "RFC3526":http://tools.ietf.org/html/rfc3526#section-8