I am verifying a signature generated using ecdsa secp256r1. The signature is getting verified but the time taken by the verification step is too long. It takes 4-5 seconds to verify the signature. The implementation is bare metal i.e. no RTOS (one realizes the use of RTOS but still the time is too long). Can you please guide a way around for this issue. How to make it work faster , the ideal verification time would be 30ms - 60ms. Here is a gist of my code
mbedtls_ecp_curve_info *curve_info = NULL; mbedtls_ecdsa_context ecdsa_context;
/// Initialization mbedtls_ecdsa_init(&ecdsa_context); curve_info = mbedtls_ecp_curve_info_from_tls_id(23); /// 23 is tls_id of secp256r1 mbedtls_ecp_group_load(&ecdsa_context.grp, curve_info->grp_id);
/// Processing result = mbedtls_ecp_point_read_binary( &ecdsa_context.grp, &ecdsa_context.Q, public_key_data, // public key data in uncompressed format i.e. including leading 0x04 sizeof(public_key_data) ); /// 32 /// 71 status_verify_signature = mbedtls_ecdsa_read_signature(&ecdsa_context, hash, sizeof(hash), signature, sizeof(sig)); /// converts the signature data to ASN1, verifies the signature
Thank you :)
Hello,
There are a few options to configure a RAM/performance or code size/performance compromise: MBEDTLS_ECP_NIST_OPTIM (activate for better performance), MBEDTLS_ECP_FIXED_POINT_OPTIM (set to 1 for better performance), MBEDTLS_ECP_WINDOW_SIZE (larger has better performance, but only up to a point).
This is unlikely to make a ×100 difference though. You may not be able to achieve the desired performance with your hardware.
Since you have no RTOS, if the problem is that you can't take interrupts while the long cryptographic calculation is running, you can enable MBEDTLS_ECP_RESTARTABLE. This allows ECDSA and ECDH operations to be performed in small chunks, with your application getting control between each chunk.
Best regards,
mbed-tls@lists.trustedfirmware.org