crypto/ecdsa: linux/arm64 Go 1.9 performance is 10X slower than OpenSSL

[williamweixiao]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version go1.9.2 linux/arm64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

GOARCH="arm64"
GOBIN=""
GOEXE=""
GOHOSTARCH="arm64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH=""
GORACE=""
GOROOT="/usr/lib/go-1.6"
GOTOOLDIR="/usr/lib/go-1.6/pkg/tool/linux_arm64"
GO15VENDOREXPERIMENT="1"
CC="gcc"
GOGCCFLAGS="-fPIC -pthread -fmessage-length=0"
CXX="g++"
CGO_ENABLED="1"

What did you do?

go test crypto/ecdsa -bench .

What did you expect to see?

Performance can be on par with OpenSSL (https://blog.cloudflare.com/content/images/2017/11/pub_key_1_core-2.png)

What did you see instead?

10X slower than OpenSSL (https://blog.cloudflare.com/content/images/2017/11/go_pub_key_1_core.png)

[crvv]

"10 times slower" is wrong.
It's "92-93% slower than OpenSSL" or "OpenSSL is 12-14 times faster than Go".

[gopherbot]

Change https://golang.org/cl/81695 mentions this issue: crypto/elliptic: implement P256 for arm64

[gopherbot]

Change https://golang.org/cl/99755 mentions this issue: crypto/elliptic: implement P256 for arm64

[vkrasnov]

Any plans to merge this before 1.11 freeze?

[vielmetti]

Comparing 1.10.2 to 1.11beta1 on Cavium ThunderX (Packet Type 2A, c1.large.arm):

ed@ed-2a-bcc-llvm:~$ go version
go version go1.10.2 linux/arm64
ed@ed-2a-bcc-llvm:~$ go test crypto/ecdsa -bench .
goos: linux
goarch: arm64
pkg: crypto/ecdsa
BenchmarkSignP256-96               10000            177160 ns/op            5622 B/op         68 allocs/op
BenchmarkSignP384-96                 200           7744608 ns/op         2342022 B/op      17552 allocs/op
BenchmarkVerifyP256-96              5000            385487 ns/op            8084 B/op        100 allocs/op
BenchmarkKeyGeneration-96          20000             74584 ns/op            1458 B/op         22 allocs/op
PASS
ok      crypto/ecdsa    30.865s
ed@ed-2a-bcc-llvm:~$ ~/go/bin/go1.11beta1 test crypto/ecdsa -bench .
goos: linux
goarch: arm64
pkg: crypto/ecdsa
BenchmarkSignP256-96               10000            143612 ns/op            6150 B/op         69 allocs/op
BenchmarkSignP384-96                 200           7736512 ns/op         2345074 B/op      17562 allocs/op
BenchmarkVerifyP256-96              5000            270518 ns/op            8189 B/op        103 allocs/op
BenchmarkKeyGeneration-96          20000             65796 ns/op            1468 B/op         22 allocs/op
PASS
ok      crypto/ecdsa    20.374s

1.11beta1 is faster than 1.10.2 but not 10x faster.

[vkrasnov]

The CL to make it faster (and GCM) is still in review. There is lack of ARM assembly reviewers. What you are seeing is mostly the result of faster bignum routines.

[vielmetti]

@vkrasnov - is this PR also related? https://go-review.googlesource.com/c/go/+/99622 looks like a previous patch series got redone.

[gopherbot]

Change https://golang.org/cl/121360 mentions this issue: crypto/elliptic: implement P256 for arm64

[vielmetti]

This is marked as milestone "unplanned", should it be attached to a release?

[bradfitz]

@vielmetti, that's not really how we use our Milestones. It's fine as-is. It'll be in Go 1.11.

[jared2501]

Awesome work on the p256 elliptic curve in arm assembly! Love it <3