Re: symbol catenation and montgomery

[phr-2000]

          mpz_powm (1024)    16.375ms

     That's pretty good!

   Isn't an 1024-bit exponent somewhat larger than one usually uses for
   RSA?  What does "openssl speed" do?

1024 bits is the usual size for RSA moduli these days.  The decryption
operation is x = y^d mod N, where N=pq and p,q are the secret prime
factors, so N is 1024 bits and p and q are 512 bits.  You normally
separately compute the residues of y^d mod p and q separately, and
then combine them to get the residue mod N.  So you turn a 1024 bit
modexp into two 512-bit modexps and some other arithmetic.  This
is about 3x faster than a full 1024-bit modexp.

Openssl speed runs repeated 1024-bit encryptions for 10 seconds and
counts how many it completes, and does the same for decryptions.
The output

          rsa 1024 bits   0.0066s   0.0004s    152.6   2660.1

means it did 152.6 decryptions/sec or 0.0066 sec each, and 2660.1
encryptions/sec or 0.0004s each.  RSA encryption is faster than
decryption because with for encryption, the exponent is normally
chosen as a small fixed number, usually 65537 but sometimes as small
as 3.  The decryption exponent is a structureless number the same
size as the modulus.