In a previous post, we spoke about LMS, XMSS and SLH-DSA in relation to wolfBoot and let you know we’d be bringing some benchmarking numbers. Voila!
| Algorithm / Parameter Set | Sig Size/Strength | Verification Time (ms) | Operations Per Second |
| LMS/HSS L2_H10_W2 | 9300 | 0.118 | 8500.588 |
| LMS/HSS L2_H10_W4 | 5076 | 0.219 | 4557.764 |
| LMS/HSS L3_H5_W4 | 7160 | 0.324 | 3088.329 |
| LMS/HSS L3_H5_W8 | 3992 | 2.638 | 379.092 |
| LMS/HSS L3_H10_W4 | 7640 | 0.312 | 3204.799 |
| LMS/HSS L4_H5_W8 | 5340 | 3.469 | 288.251 |
| XMSS-SHA2_10_256 | 2500 | 0.546 | 1829.883 |
| XMSS-SHA2_10_192 | 1492 | 0.533 | 1875.973 |
| XMSSMT-SHA2_20/2_256 | 4963 | 0.954 | 1047.815 |
| XMSSMT-SHA2_20/4_256 | 9251 | 1.917 | 521.76 |
| XMSSMT-SHA2_40/4_256 | 9893 | 1.896 | 527.548 |
| XMSSMT-SHA2_40/8_256 | 18469 | 3.855 | 259.416 |
| XMSSMT-SHA2_60/6_256 | 14824 | 2.917 | 342.852 |
| XMSSMT-SHA2_60/12_256 | 27688 | 5.545 | 180.349 |
| XMSSMT-SHA2_20/2_192 | 2955 | 1.063 | 941.004 |
| XMSSMT-SHA2_20/4_192 | 5403 | 2.058 | 485.909 |
| XMSSMT-SHA2_40/4_192 | 5885 | 2.174 | 459.919 |
| XMSSMT-SHA2_40/8_192 | 10781 | 4.149 | 241.012 |
| XMSSMT-SHA2_60/6_192 | 8816 | 3.155 | 316.973 |
| XMSSMT-SHA2_60/12_192 | 16160 | 6.395 | 156.381 |
| SLH-DSA-S | 128 | 2.457 | 407.034 |
| SLH-DSA-F | 128 | 7.771 | 128.683 |
| SLH-DSA-S | 192 | 3.877 | 257.908 |
| SLH-DSA-F | 192 | 11.352 | 88.089 |
| SLH-DSA-S | 256 | 5.604 | 178.431 |
| SLH-DSA-F | 256 | 11.362 | 88.015 |
| ECDSA SECP256R1 | 256 | 2.092 | 477.91 |
Note that these are only measurements for the verification operation. Key generation and signing are notably slower and generally only done as off-line operations for hash-based signature schemes. For LMS and XMSS the second column is the signature size. For SLH-DSA and ECDSA it is bit strength. Here it is as a pretty graph.
Let’s make some interesting observation about these benchmark numbers:
- ECSDA doesn’t belong in a chart of post-quantum algorithms; it’s just there for comparison purposes.
- LMS, depending on its parameter sets, has the best performance far and away beating even ECDSA.
- XMSS has the greatest variation in performance which has a relationship to the signature size and number of available signatures per key pair.
- For SLH-DSA there are F and S variants. F stands for fast while S stands for small, but the numbers tell a different story as the S variants take less time! The reason? Fast refers to signing time.
Key take aways:
- If you pick the right parameter set, your performance will be on par or beat ECDSA.
- Our advice to just use LMS when you’re not sure is supported by these numbers.
- If you use SLH-DSA and you care about verification time, don’t use the Fast variant.
If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now