I am comparing the performance of the ECDSAP256 signature algorithm and RSA3072 on OpenSSL.
I first used
openssl speed to test algorithm performance:
RSA3072 signs 356.2 time/second and verify 17625.1 time/second;
ECDSAP256 signs 28096.7 time/second and verify 9462.5 time/second;
Then I created a server with a P256 certificate and a server with an RSA3072 certificate. Both of them are signed by a self-signed root CA. All these certificates are created using the OpenSSL command. They are stored in folder
I tested the handshake performance using
openssl s_server and
openssl s_time on TLS 1.3. The result showed here:
7380 connections in 5.02s; 1470.12 connections/user sec, bytes read 0
7380 connections in 31 real seconds, 0 bytes read per connection
19755 connections in 16.49s; 1198.00 connections/user sec, bytes read 0
19755 connections in 31 real seconds, 0 bytes read per connection
The testing commands are here,
$1 need to be replaced by the folder name
openssl s_server -key $1/server/server.key -cert $1/server/server.pem -accept 4330
-CAfile $1/rootCA/demoCA/root.pem -verify_return_error -state -WWW
openssl s_time -connect localhost:4330 -CAfile $1/rootCA/demoCA/root.pem -new
I first thought the result is reasonable since RSA3072 verify faster than P256. But then I realize that in TLS 1.3 server needs to send a
CertificateVerify which is signed using the server's private key. Therefore, in theory, the server using the P256 certificate should set up the handshake faster than the server using the RSA3072 certificate.
Then I run
-msg and I found that the
CertificateVerify was indeed generated and sent. Both servers use x25519 for key exchange.
Is there any error in my experiment?
How did the CertificateVerify generate? Could it be generated before the handshake?