not sure that's right...

for interactive use, compared to rendering to the display and pushing the packet out the crypto overhead is going to be minuscule

Once you have authenticated each other and agree to a nice symmetric cipher and exchange the keys for that, yes. Bytes, even kilobytes per second. But note the "once you have authenticated". Public key crypto is brutal number crunching and takes minutes to hours on systems of the 80s, and some noticeable seconds even in the late 90s. I think that's why something like RSA-4096 was not just universally adopted 30 years ago. It was too expensive to compute for casual use.

even the crappiest laptop CPU can do 10000 x 4096-bit RSA signature verifications per second

my 2014 laptop (on battery, no hardware acceleration):

                      sign    verify    sign/s verify/s
    rsa 4096 bits 0.006200s 0.000096s    161.3  10468.9

(not to mention everyone's using ec these days, which is quite a bit faster)

Since you mention EC, it uses floating point. Good ol' FLOPS is not a wholly useless metric there. The first commercial processor sold with a floating point unit integrated was the 486 in 1989. Some rough, unsourced numbers:

    1984 - Cray X-MP (expensive!)         800 MFLOPS  
    1989 - Intel 486 @ 33 MHz             3 
    1993 - Pentium @ 60 MHz               10
    1997 - Pentium II @ 233 MHz           200
    2000 - Pentium III @ 1000 MHz         2000
    2004 - Pentium 4 @ 2800 MHz           5650 
    2007 - Core Quad @ 2400 MHz           38400 
    2009 - Core i7-950 @ 3100 MHz         92820
    2013 - Apple A7 (smartphone)          115000
    2020 - Apple M1                       2844000

A FP calculation that takes 1 second on an Apple M1 will take 11 hours on the original Pentium, approximately. Hope that gives some perspective.

even if it's 15000 times slower than my 2014 laptop (which it isn't): the ECDH operation still takes under a second

and that's the expensive operation (done once per connection)

I am making the same mistake that the other poster did, in assuming too much background familiarity. Those are 90s chips. This software runs on machines from the late 1980s. The trend scales further back as it does forward. Five years is always a long time in computer performance.

The 486, the slowest chip on my list blasts the early Macs (which this software runs on) out of the water by 100x. I went and researched it and the the 68882 FPU at 25 MHz is about 0.25 MFLOPS: http://www.faqs.org/faqs/motorola/68k-chips-faq/

Stunning, but that is the difference between 1985 and 1989 technology.

The first Macs were 8 MHz 68000 chips. The GUI was still very responsive. The menus popped down and Quickdraw (the graphics library) properly handled arbitrarily shaped overlapping windows. There was a demo with a round window and windows in the background updated perfectly. Bill Atkinson invented the Regions data structure (and the rest of Quickdraw) that allowed among other things, background windows graphics calls to be clipped to arbitrary combinations of foreground windows super efficiently. Atkinson is one of the greats.

https://www.folklore.org/StoryView.py?project=Macintosh&stor...

https://www.folklore.org/StoryView.py?project=Macintosh&stor...

> I am making the same mistake that the other poster did, in assuming too much background familiarity. Those are 90s chips. This software runs on machines from the late 1980s. The trend scales further back as it does forward.

my point was on interactive use (i.e. using AES or ChaCha)

you are the one that diverted the topic towards RSA-4096 (which no-one uses), moving the goalposts (twice)

(and yes, I saw the deleted post)

Yep. AES will run fine on any of these machines. These machines are in practice still sort of usable with SSH, with some patience for login depending on protocol.

I deleted the post because I was a bit too aggressive, but apparently the damage was done. I apologize for lecturing you like a prat.

It just occurred to me while reading this comment that people born after Intel CPUs mostly leveled out perfwise are probably peers now. That realization came hard, it came fast, and I wasn’t ready to live with that knowledge by a long shot.

It was a long, long road to your 2014 laptop, friend. There was a time when division was a luxury, and desperate folk offered their firstborn for forbidden tricks to compute inverse square root. Elliptic curve, you say? You mean floating point math? Whoo-ee!

Cmon now, intel chips didn't level off till around 2010.

The 68k Macs are < 60MHz and the early PowerPCs were not a lot faster. Your 2014 laptop will run circles around them doing just about anything.

We’re talking about an unoptimized 1990’s 44mhz CPU here aren’t we?

How is it at all comparable to a relatively state of the art 2014 laptop?

This is a 68040. I had a cut down version (68LC040 — low cost) in my Mac LC475 in the mid ‘90s. You have no idea how slow it is haha.

Power7+ came out in 2012 which was the first gen of Power CPUs to include AES acceleration. [1]

The most powerful Power Macs with non Intel CPUs were discontinued in 2006. (G5, released 2003.) [2]

Your laptop from 2014 was already running at LEAST a 64bit CPU and likely has AES instructions as they were introduced in 2010 [3]

So even if your laptop from 2014 onward didn't include AES instructions like some Intel Atom/Celeron/Pentium models... (Acer C720P Chromebook, for example came out in 2014 and has a Intel Celeron 2955U [4] and [5]) It was still an architecture that is/was ELEVEN YEARS NEWER. A Celeron 2955U is roughly equivalent in performance to a Core 2 Duo E4700 or an AMD Athlon 64 x2 5200+ ... which is still quite ahead of a PowerMac G5. [6] and [7]

TLDR: Time marches on and along with cpu improvements come instructions and other benefits not immediately visible to the end user.

Try using your old 2003-era system to generate keys again and tell us how fun it is. Bonus if you try it on a Pre-2000 era Performa Mac as a user typically had with SystemOS 7, 8 and 9. Those ran at 16 to 66mhz. [8]

For reference, SystemOS 7 came out in 1991. [9] OS8 came out in 1997. [10] And OS9 came out in 1999. [11]

The CPUs inside the Performa Macs running System 7, OS8 and OS9, at best, can be compared to the 486s on the Intel side. Not even Pentium level. This places the architecture at LEAST a dozen architecture generations behind what you're generating keys on. This means if the CPUs we're looking at here were aged up, your laptop is starting first or second grade while the actual CPUs of the time are now finishing their masters' degrees with a kid or two on the way.

Rather than naively using your extremely modern in comparison 'crappy laptop' cpu as a reference point, perhaps you should use something more typical from the time these OSes were considered relevant.

TLDR to the TLDR: Get off my lawn.

[1] https://www-01.ibm.com/common/ssi/ShowDoc.wss?docURL=/common...

[2] https://en.wikipedia.org/wiki/Power_Mac_G5

[3] https://software.intel.com/content/www/us/en/develop/article...

[4] https://www.amazon.com/Acer-C720P-2666-Chromebook-11-6-Inch-...

[5] https://ark.intel.com/content/www/us/en/ark/products/75608/i...

[6] https://www.cpubenchmark.net/compare/Intel-Celeron-2955U-vs-...

[7] https://www.phoronix.com/scan.php?page=news_item&px=PowerMac...

[8] https://en.wikipedia.org/wiki/Macintosh_Performa

[9] https://en.wikipedia.org/wiki/System_7

[10] https://en.wikipedia.org/wiki/Mac_OS_8

[11] https://en.wikipedia.org/wiki/Mac_OS_9

> Your laptop from 2014 was already running at LEAST a 64bit CPU and likely has AES instructions as they were introduced in 2010 [3]

I'm totally sure the RSA operations are using the AES instructions

> Try using your old 2003-era system to generate keys again and tell us how fun it is.

generating (fresh) rsa keys? you don't do that on connection to a SSH server

as for what actually happens on connect, 2004 laptop: 33 signatures/second and 2200 verifications/second (+DH/ECDH)

the RSA operation (verifying the server's host key) took a total of 0.0005s

even my raspberry pi 1 can do 240 4096-bit verifications/s and several thousand ECDH's/second

and I have yet to see a SSH server with 4096-bit host keys

tldr: even old computers are fast (and data > supposition)

Your damn 2004 laptop could emulate the Amiga and the Mac with a 68k CPU in parallel.

The Rpi? For FFS, an Rpi B+, a PSP, or a 2003 Athlon XP could emulate a System7 era Mac with a Quadra setup without a single slowdown.

TLDR: You're not using era appropriate examples.

I told you to get off my lawn.

I did exactly what you told me to

I suggest reading up on how the SSH protocol works

There are people in this thread with actual experience and actual bench times using these protocols on machines of that period

https://news.ycombinator.com/item?id=28022299

https://news.ycombinator.com/item?id=28023337

You must be young. The gap between 1989 and 1999 in computer terms is inmense, far more than the gap between 2010 and 2020. You could emulate a 1989 m68k Mac/Amiga on a Pentium 3 from 1999, for example with BasiliskII/UAE.

Performance increase did not stop; smaller, better designs. The exponential is just a bit lower.

We don't realize it, just as someone using a text terminal may have not realised it between 1985 and 1995, if every response after a key press was already instant.

For typical GUI interfaces, tasks like tossing video data around, and so on, computers became approximately inifinitely fast sometime c. 2005 - 2010.

Eh, no. Windows' 10 UI latency it's abhorrent.

If any, current gens with Electron crap are doing it far worse. Far, far worse.