triple DH

Christian Grothoff christian at
Thu May 21 13:36:57 CEST 2015

On 05/21/2015 11:17 AM, Werner Koch wrote:
> On Wed, 20 May 2015 12:41, wk at said:
>> Thus this is about generating keys in a way to allow point compression
>> in a non-patent encumbered way.  Meanwhile the point compression patent
> The reason for the lower speed can not be attributed to Jivsov's trick
> but the fact that we convert to affine coordinates twice (which requires
> an inversion).  The attached patch remove the double conversion.
> Does this help?
Short answer: no.

Long answer: Measurements show that for

ECDHE nist_generate_key() calls 38x gcry_mpi_ec_mul_point via
_gcry_ecc_ecdsa_sign and 77x via gcry_ecc_ecdsa_verify and 38x via

while for

EdDSA nist_generate_key() calls 12x gcry_mpi_ec_mul_point via
_gcry_ecc_ecdsa_sign and 23x via gcry_ecc_ecdsa_verify, and 12x via

Detailed measurement plots were too big for the list (> 40k).


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20150521/575c6cb3/attachment.sig>

More information about the Gcrypt-devel mailing list