Problem - Kevin Tafuro

For many different reasons, it can be fairly difficult to get timing numbers that are
completely accurate. Often, internal clocks that the programmer can read are somewhat
asynchronous from the core processor clock. More significantly, there’s often
significant overhead that can be included in timing results, such as the cost of context
switches and sometimes timing overhead.
Some CPUs, such as AMD’s Athlon, are advertised such that the
actual clock speed is not obvious. For example, the Athlon 2000 runs
at roughly 1666 MHz, significantly less than the 2000 MHz one might
suspect.
Generally, you’ll want to find out how quickly a primitive or algorithm can process a
fixed amount of data, and you’d like to know how well it does that in a real-world
environment. For that reason, you generally shouldn’t worry much about subtracting
out things that aren’t relevant to the underlying algorithm, such as context
switches and procedure call overhead. Instead, we recommend running the algorithm
many times and averaging the total time to give a good indication of overall
performance.
In the following sections we’ll discuss timing basics, then look at the particulars of
timing cryptographic code.
Timing basics
You need to be able to record the current time with as much precision as possible.
On a modern x86 machine, it’s somewhat common to see people using inline assembly
to call the RDTSC instruction directly, which returns the number of clock cycles
since boot as a 64-bit value. For example, here’s some inline assembly for GCC on
32-bit x86 platforms (only!) that reads the counter, placing it into a 64-bit unsigned
long long that you pass in by address:
#define current_stamp(a) asm volatile("rdtsc" : "=a"(((unsigned int *)(a))[0]),\
"=d"(((unsigned int *)a)[1]))
The following program uses the above macro to return the number of ticks since
boot:
#include
int main(int argc, char *argv[ ]) {
spc_uint64_t x;
current_stamp(&x);
printf("%lld ticks since boot (when I read the clock).\n", x);
return 0;
}
RDTSC is fairly accurate, although processor pipelining issues can lead to this technique’s
being a few cycles off, but this is rarely a big deal.
Timing Cryptographic Primitives | 151
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.