32 bit vs 64 bit for Elliptic Curves

[Robert Moskowitz]

There is extensive discussion on the IRTF's crypto list on choosing the 
next Elliptic Curve algorithm  EC25419 may be leading in the discussions.

But the interest here is dealing with lots of ECC calculations on a 
server that is running an SMTP MTA using STARTTLS and DANE a lot. In 
such a case, being able to do lots of EC calcs is important. This gets 
us to comparing the armv7 to the armv8.  I have been told that the armv8 
is 64bits, so...

Is there support for armv8 systems with F21 and of course are there 
affordable armv8 cards?  Or am I getting too ahead of the curve?  ;)

[Peter Robinson]

On Thu, Aug 7, 2014 at 3:50 AM, Robert Moskowitz <rgm(a)htt-consult.com&gt; wrote:
>  There is extensive discussion on the IRTF's crypto list on
> choosing the next
>  Elliptic Curve algorithm  EC25419 may be leading in the discussions.
>
>  But the interest here is dealing with lots of ECC calculations on a server
>  that is running an SMTP MTA using STARTTLS and DANE a lot. In such a case,
>  being able to do lots of EC calcs is important. This gets us to comparing
>  the armv7 to the armv8.  I have been told that the armv8 is 64bits, so... 
Is that really what the IRTF considers a useful standard representative usecase?

>  Is there support for armv8 systems with F21 and of course are there
>  affordable armv8 cards?  Or am I getting too ahead of the curve?  ;) 
Define "ARMv8"? There's aarch64 support for the ARMv8 architecture as
a secondary architecture (see the daily rawhide reports to this list)
but you can run an ARM 32 bit userspace on those chips.

There's also hardware available but define "affordable"... at the
moment the first gen widely available hardware will set you back about
USD$ 3K

Ultimately ARMv7 / 32 bit isn't going away quickly, ARMv8 is 64 bit,
both have NEON SIMD which provides 128bit SIMD instructions and
there's the ability to use those units to optimise offload of crypto
functions so I suspect NEON is likely the best means of achieving
speed and optimisation use case that will work across both platforms.
ARMv8 has HW optimised crypto extensions but they'll be for existing
cyphers and I've no idea how useful they will be for future standards.

Peter

[1] http://www.arm.com/products/processors/technologies/neon.php

[Robert Moskowitz]

ANd I should have remembered that when I started going down the F21arm 
rabbit hole, I saw the reference the the arm64 development. Just too 
much going around in my head.  And all of this is just precursors to 
what I really want to do.

On 08/07/2014 04:28 AM, Peter Robinson wrote:
>  On Thu, Aug 7, 2014 at 3:50 AM, Robert Moskowitz
> <rgm(a)htt-consult.com&gt; wrote:
> > There is extensive discussion on the IRTF's crypto list on choosing the next
> > Elliptic Curve algorithm  EC25419 may be leading in the discussions.
> >
> > But the interest here is dealing with lots of ECC calculations on a server
> > that is running an SMTP MTA using STARTTLS and DANE a lot. In such a case,
> > being able to do lots of EC calcs is important. This gets us to comparing
> > the armv7 to the armv8.  I have been told that the armv8 is 64bits, so...
>  Is that really what the IRTF considers a useful standard representative usecase? 
It is one of the cases brought to the IRTF by the IETF.  There is a fair 
amount of traffic back and forth, and honestly I have fallen behind by 
quite a few days worth of mails.

> > Is there support for armv8 systems with F21 and of course are there
> > affordable armv8 cards?  Or am I getting too ahead of the curve?  ;)
>  Define "ARMv8"? There's aarch64 support for the ARMv8 architecture as
>  a secondary architecture (see the daily rawhide reports to this list)
>  but you can run an ARM 32 bit userspace on those chips. 
Yes.  Just too much going on and random bits popping out at times. I DID 
see that over a week ago.  Definitely a senior moment.
>  There's also hardware available but define "affordable"... at the
>  moment the first gen widely available hardware will set you back about
>  USD$ 3K 
I am going to have to have some fun with my colleagues at these 
standards meetings that show ARM as their employer.  "Oh we have handled 
that item in our v101 chip which you will be seeing in products soon."  ;)

>  Ultimately ARMv7 / 32 bit isn't going away quickly, ARMv8 is 64 bit,
>  both have NEON SIMD which provides 128bit SIMD instructions and
>  there's the ability to use those units to optimise offload of crypto
>  functions so I suspect NEON is likely the best means of achieving
>  speed and optimisation use case that will work across both platforms.
>  ARMv8 has HW optimised crypto extensions but they'll be for existing
>  cyphers and I've no idea how useful they will be for future standards. 
No.  Never said it would.  In fact I work with sensor vendors that are 
still doing 8 bit chip designs.  They can't afford 32bit.  For them I 
design security stuff that will work within their 30KB limits on those 8 
bit chips.  This is for other things.

Thanks for all your help, Peter.

[Eric Smith]

On Thu, Aug 7, 2014 at 2:28 AM, Peter Robinson <pbrobinson(a)gmail.com&gt; wrote:
>  There's also hardware available but define
> "affordable"... at the
>  moment the first gen widely available hardware will set you back about
>  USD$ 3K 
Where can one get that?  I don't want to spend $5-6K, which is all the
prices I've seen, but $3K is nearly within my budget for development
hardware.

[Peter Robinson]

On Fri, Aug 8, 2014 at 11:01 PM, Eric Smith <spacewar(a)gmail.com&gt; wrote:
>  On Thu, Aug 7, 2014 at 2:28 AM, Peter Robinson
> <pbrobinson(a)gmail.com&gt; wrote:
> > There's also hardware available but define "affordable"... at the
> > moment the first gen widely available hardware will set you back about
> > USD$ 3K
>
>  Where can one get that?  I don't want to spend $5-6K, which is all the
>  prices I've seen, but $3K is nearly within my budget for development
>  hardware. 
http://www.amd.com/en-us/who-we-are/corporate-information/events/arm

[Eric Smith]

On Thu, Aug 7, 2014 at 2:28 AM, Peter Robinson <pbrobinson(a)gmail.com&gt; wrote:
>  at the
>  moment the first gen widely available hardware will set you back about
>  USD$ 3K 
On Fri, Aug 8, 2014 at 4:48 PM, Peter Robinson <pbrobinson(a)gmail.com&gt; wrote:
>  http://www.amd.com/en-us/who-we-are/corporate-information/events/arm
I wouldn't call that "widely available". One has to apply for
permission to buy it, and sign a "System Agreement" (NDA?).

[Peter Robinson]

On Sat, Aug 9, 2014 at 12:53 AM, Eric Smith <spacewar(a)gmail.com&gt; wrote:
>  On Thu, Aug 7, 2014 at 2:28 AM, Peter Robinson
> <pbrobinson(a)gmail.com&gt; wrote:
> > at the
> > moment the first gen widely available hardware will set you back about
> > USD$ 3K
>
>  On Fri, Aug 8, 2014 at 4:48 PM, Peter Robinson <pbrobinson(a)gmail.com&gt; wrote:
> > http://www.amd.com/en-us/who-we-are/corporate-information/events/arm
>
>  I wouldn't call that "widely available". One has to apply for
>  permission to buy it, and sign a "System Agreement" (NDA?). 
The applied micro one is about the same price but I'm too lazy to find
the link. People on the Fedora ARM channel have purchased them too.

They're still not widely available in that you can't get them from the
corner store.... there are devices that are generally available
though. Ultimate split the hair how ever you like!

Peter

[Eric Smith]

On Sat, Aug 9, 2014 at 6:34 AM, Peter Robinson <pbrobinson(a)gmail.com&gt; wrote:
>  The applied micro one is about the same price but I'm too lazy to
> find
>  the link. People on the Fedora ARM channel have purchased them too.
>  They're still not widely available in that you can't get them from the
>  corner store. 
The Applied Micro one is $5K, and you have to apply for approval to
buy that one too.

I don't expect "widely available" to mean "get them from the corner
store".  I do expect it to mean that I don't have to apply for special
permission to buy it.  If it's "widely available", I just give them my
address and credit card number, don't sign any other agreement, and it
shows within a week or two, and they don't care whether I use it for
software development, a doorstop, or target practice.

Anyhow, it looks like "widely available" meeting my criteria should
happen before the end of the year.

[Eric Smith]

On Fri, Aug 8, 2014 at 4:48 PM, Peter Robinson <pbrobinson(a)gmail.com&gt; wrote:
>  On Fri, Aug 8, 2014 at 11:01 PM, Eric Smith
> <spacewar(a)gmail.com&gt; wrote:
> > On Thu, Aug 7, 2014 at 2:28 AM, Peter Robinson <pbrobinson(a)gmail.com&gt; wrote:
> >> There's also hardware available but define "affordable"... at the
> >> moment the first gen widely available hardware will set you back about
> >> USD$ 3K
> >
> > Where can one get that?  I don't want to spend $5-6K, which is all the
> > prices I've seen, but $3K is nearly within my budget for development
> > hardware.
>
>  http://www.amd.com/en-us/who-we-are/corporate-information/events/arm 
So it turns out that AMD is not actually willing to sell these for
$3K.  They are willing to rent them out for two years for $2999, but
the agreement requires that they be returned to AMD or destroyed (at
AMD's option) at the conclusion of the two year term.  The term can be
extended by mutual agreement in two month increments, but AMD is under
no obligation to do so.

Perhaps $125/month rental (paid in advance for two years) is still
worthwhile for some developers, but I'm not willing to do that.  If I
pay $3K for a system, I'm willing to agree to non-disclosure for up to
two years, but not that I have to surrender posession in two years.

Since production hardware should be available fairly soon (claimed
4Q2014, but I think 1H2015 is more believable), I'll wait and buy
hardware that I can actually own.

Eric