Benchmark: web-crypto RSA - MeasureThat.net

Script Preparation code:

let key256, key512;

(async () => {
key256 = (await crypto.subtle.generateKey({
        name: 'RSASSA-PKCS1-v1_5',
        modulusLength: 2048,
        publicExponent: new Uint8Array([1, 0, 1]),
        hash: 'SHA-256',
    },
    false,
    ['sign', 'verify']
)).privateKey;

key512 = (await crypto.subtle.generateKey({
        name: 'RSASSA-PKCS1-v1_5',
        modulusLength: 2048,
        publicExponent: new Uint8Array([1, 0, 1]),
        hash: 'SHA-512',
    },
    false,
    ['sign', 'verify']
)).privateKey;
})();

async function sign256(path) {
    const encoder = new TextEncoder();
    const data = encoder.encode(path);
    const signature = await crypto.subtle.sign({
        name: 'RSASSA-PKCS1-v1_5'
    }, key256, data);
    const hashArray = Array.from(new Uint8Array(signature));
    const base64Hash = btoa(String.fromCharCode(...hashArray))

    return base64Hash + '/' + path;
}

async function sign512(path) {
    const encoder = new TextEncoder();
    const data = encoder.encode(path);
    const signature = await crypto.subtle.sign({
        name: 'RSASSA-PKCS1-v1_5'
    }, key512, data);
    const hashArray = Array.from(new Uint8Array(signature));
    const base64Hash = btoa(String.fromCharCode(...hashArray))

    return base64Hash + '/' + path;
}

Tests:

sha512
sign512('500x500/top/raw.githubusercontent.com/cshum/imagor/master/testdata/gopher.png').then(result => result)
sha256
sign256('500x500/top/raw.githubusercontent.com/cshum/imagor/master/testdata/gopher.png').then(result => result)

Rendered benchmark preparation results:

Suite status: <idle, ready to run>

Previous results

Test case name	Result
sha512
sha256

Fastest: N/A

Slowest: N/A

Latest run results:

Run details: (Test run date: 8 days ago)

User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Browser/OS: Chrome 135 on Windows

View result in a separate tab

Test name	Executions per second
sha512	81436.5 Ops/sec
sha256	76751.6 Ops/sec

Autogenerated LLM Summary (model gpt-4o-mini, generated 8 days ago):

LLMs can make mistakes. Check important info.

The benchmark defined in the provided JSON focuses on measuring the performance of two different hashing algorithms—SHA-256 and SHA-512—through the use of the Web Crypto API for digital signatures. The test case executes signing operations for a file (in this case, a PNG image) using both algorithms and compares their execution speeds.

### Comparison of Options

1. **SHA-256 vs. SHA-512**:
   - **SHA-256**:
     - **Pros**: 
       - Generally faster than SHA-512 in many implementations with smaller input sizes.
       - Produces a shorter hash (256 bits), which potentially uses less bandwidth when transmitting hashes.
       - Well-suited for various applications due to its balance between speed and security.
     - **Cons**: 
       - Considered to be less secure than SHA-512 against certain types of attacks (although still secure for most practical applications).
   - **SHA-512**:
     - **Pros**:
       - Offers higher security, particularly against pre-image attacks and collisions in certain contexts, making it a better choice for cryptographic applications needing enhanced security.
       - Can be more efficient for larger inputs due to its design; it processes data in larger blocks (1024 bits instead of 512 bits).
     - **Cons**:
       - Typically slower than SHA-256 for smaller inputs due to the larger processing overhead.
       - Generates larger hash output (512 bits), which can increase transmission size.

### Libraries Used

The benchmark leverages the **Web Crypto API**, a built-in JavaScript API that provides cryptographic operations such as hashing, signing, and encryption. The API enables secure generation and management of keys, allowing JavaScript applications to perform various cryptographic functions in a standardized and secure manner.

### Special JavaScript Features

The code uses modern JavaScript features including:
- **Async/Await**: The use of `async` functions and `await` for asynchronous operations simplifies the handling of asynchronous code. This allows the benchmarks to perform key generation and signing operations without blocking the main execution thread, resulting in smoother user experiences.
- **Typed Arrays**: The code utilizes `Uint8Array` to define the public exponent for the RSA key generation and `TextEncoder` to encode the data into a byte array for signing. Typed arrays facilitate efficient manipulation of binary data.

### Considerations and Alternatives

1. **Performance Metrics**:
    - The benchmark measures the number of "Executions Per Second" for both algorithms, which provides a concrete metric to compare the algorithms' performance in the specific context of signing operations.

2. **Alternatives**:
    - Other hashing algorithms could be used for benchmarking, such as SHA-1 or BLAKE2. These alternatives might offer different performance and security trade-offs.
    - Instead of using the Web Crypto API, one could implement cryptographic functions using third-party libraries such as CryptoJS or Forge. However, this could lead to inconsistencies in performance, browser support, and security practices compared to the standardized Web Crypto API.

3. **Impact of Environment**:
   - The browser and operating system (in this case, Chrome on Windows) can significantly affect performance results. Different engines may optimize cryptographic operations differently. Thus, benchmarks should ideally be run on multiple environments to obtain a comprehensive view of performance.

4. **Input Data**:
   - The input data to be signed (the image in this case) is also important because the size and type of data can affect the performance of hashing and signing operations. The benchmark tests a specific data path (`'500x500/top/raw.githubusercontent.com/cshum/imagor/master/testdata/gopher.png'`), and changing this path or data could yield different execution times.

### Conclusion

This benchmark is a relevant exercise in understanding cryptographic performance in web applications, demonstrating how different hashing methods can be compared using the Web Crypto API. Such performance insights help developers make informed decisions when choosing appropriate algorithms for their applications based on security requirements and processing speed.

Related benchmarks:

web-crypto RSA (version: 1)

comparing sha256 vs sha512 performance based on https://www.measurethat.net/Benchmarks/Show/27514/3/web-crypto

Comparing performance of: sha512 vs sha256

Created: 8 days ago by: Guest

Jump to the latest result

sha512

sha256

Suite status: <idle, ready to run>

Experimental features:

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model gpt-4o-mini, generated 8 days ago):