I have started to read more about ECDH/ECDHE and am wondering if it has the similary issues as RSA - i.e. the processing power required for the decryption of private key is more than of the public key. If so, then are there are hardware accelerators available for these ciphers. I did not find them by a google search and so posting this here. Thanks for any inputs


You do not "decrypt the private key", you "use the private key for decryption".

ECDH is not an asymmetric encryption algorithm but a key exchange algorithm. Key exchange algorithms are like asymmetric encryption algorithms in which you do not get to choose the message which is encrypted -- but that's just as fine when you just want to establish a shared secret value, to be used for symmetric encryption, as is the case in SSL/TLS.

In ECDH, each involved party will compute two equivalent operations, which, on elliptic curves is the multiplication of a curve point by an integer. A simple PC, using a single core, has enough computing power to do that more than ten thousand times per second with the standard P-256 curve (which is as robust as you can hope for). This hardly mandates the use of an hardware accelerator: in HTTPS, such an operation will occur only once per client, when the client opens its first connection. Each connection will be used for several HTTP request, and extra connection will use the "abbreviated handshake" which use symmetric cryptography only.

You might want to do the ECDH and similar operations in some specific hardware, not for performance, but for security: private keys are sensitive objects, they are best kept in tamper resistant devices which will protect them from theft, even against local attackers. Such devices are known as Hardware Security Modules. When a HSM is used, the private key never leaves the HSM, and the HSM does the cryptographic operation. Some HSM support elliptic curves, e.g. recent Thales' nShield HSM.

  • Sorry I should have also added that I am started reading about ECHD in conjunction with SSL. Today there are multiple hardware SSL accelerators in the market because of the following reason: during the SSL negotiation, the symmetric key (more accurately, data that is used to generate the symmetric key) is encrypted by the SSL server RSA public key and decrypted by the SSL server RSA private key. The decryption is computationally intensive and so SSL accelerators are needed. From your answer, it looks that if we use ECDH, the SSL server does not need accelerator. Pls confirm – Ramana Apr 10 '13 at 19:39
  • Actually RSA accelerators are rarely needed: a simple PC will do at least 300 RSA decryption per second, with a single core, and a big RSA key (2048 bits). A quad-core server will process more than one thousand new connections per second. It takes a lot of traffic to really "need" an hardware accelerator. When hardware is used, it is often for security (the tamper resistance of HSM), not for performance. – Thomas Pornin Apr 10 '13 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.