Scale ops count for larger curves
From a user's perspective, you want a "basic operation" to take approximately
the same amount of time regardless of the curve size, especially since max_ops
is a global setting: otherwise if you pick a limit suitable for P-384 then
when you do an operation on P-256 it will return way more often than needed.
Said otherwise, a user is actually interested in actual running time, and we
do the API in terms of "basic ops" for practical reasons (no timers) but then
we should make sure it's a good proxy for running time.
diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h
index 314e4b2..9521875 100644
--- a/include/mbedtls/ecp.h
+++ b/include/mbedtls/ecp.h
@@ -268,20 +268,22 @@
* Lower (non-zero) values mean ECC functions will block for
* a lesser maximum amount of time.
*
- * \note A "basic operation" is roughly multiplication in GF(p),
- * or whatever takes a roughly equivalent amount of time.
- * As an indication, a scalar multiplication on P-256 is
- * of the order of 3300 "basic operations" with default
- * settings.
+ * \note A "basic operation" is defined as a rough equivalent of a
+ * multiplication in GF(p) for the NIST P-256 curve.
+ * As an indication, with default settings, a scalar
+ * multiplication (full run of \c mbedtls_ecp_mul()) is:
+ * - about 3300 basic operations for P-256
+ * - about 9400 basic operations for P-384
*
* \warning Very low values are not always respected: sometimes
* functions need to block for a minimum number of
* operations, and will do so even if max_ops is set to a
* lower value. That minimum depends on the curve size, and
* can be made lower by decreasing the value of
- * \c MBEDTLS_ECP_WINDOW_SIZE. As an indication, the minimum
- * is around 160 for P-256 with \c MBEDTLS_ECP_WINDOW_SIZE
- * set to 4.
+ * \c MBEDTLS_ECP_WINDOW_SIZE. As an indication, with that
+ * parameter set to 4, the minimum amount of blocking is:
+ * - around 165 basic operations for P-256
+ * - around 330 basic operations for P-384
*/
void mbedtls_ecp_set_max_ops( unsigned max_ops );
#endif /* MBEDTLS_ECP_EARLY_RETURN */