Signature verification performance: the right frame

Mental model

In the previous three lessons you saw the cost (in bytes) on the key exchange side of TLS, IKEv2 and SSH. This lesson focuses on the performance cost (in time) on the signature side, and in doing so shows one of this course’s most repeated disciplines with its clearest example: an institution’s raw data, a ratio derived from that data, and the fact that the ratio may not even fully match the institution’s own verbal statement.

BIS’s raw data: two numbers, straight from the source

The Bank for International Settlements’ Project Leap Phase 2 report (othp107) gives two average verification times in Graph 5 on page 23: PQC signature verification 209.9 ms^SOURCED, RSA signature verification 28.1 ms^SOURCED. These are figures BIS really measured and really published; the SOURCED tag means exactly that.

The derived ratio: division, shown

BIS’s report does not compute a ratio (how many times slower) from these two figures; it gives only the two raw numbers. This course itself derives a ratio by dividing them: 7.47×^DERIVED (209.9 / 28.1 = 7.47…). This is a live example of exactly what the DERIVED tag means: the number itself does not appear in BIS’s report, but we compute it ourselves, with demonstrable arithmetic, from the two figures BIS published. Keeping this distinction clear matters: “BIS says 7.47x” is wrong; “the two figures BIS gives produce 7.47x” is right.

Loose inconsistency with BIS’s own wording

There is an interesting detail here: the prose of BIS’s own report says PQC verification is “at least an order of magnitude” (that is, at least ~10 times) slower than classical verification. But the real ratio derived from its own raw data is ~7.47x, below 10. That does not mean BIS is lying (“at least an order of magnitude” may be a rough rounding, or may cover different test scenarios), but it is an example of BIS’s own prose not fully matching its own chart. Showing an architect this nuance is a concrete application of the discipline “check even the source’s own text, not just a number”.

A third, separate figure: the corpus’s own local-lab estimate

During this research a third figure appeared, completely independent of BIS’s: the corpus’s own preparation notes contain an estimate that “ML-DSA-65 verification is 5-15x×^ESTIMATED slower than RSA-2048 (hardware-dependent)”, explicitly not attributed to BIS, as an expectation for a local lab measurement. These three figures (BIS’s 209.9ms/28.1ms raw data, the 7.47x derived from it, and the corpus’s independent 5-15x estimate) do not “converge” and do not “confirm” each other; they come from different sources, different hardware and different methods. When presenting all three to an architect, the right frame is not “which is right” but “what does each measure, and on which hardware does each hold”. If you want to know the real performance impact on your own bank, you need to make your own measurement on your own hardware; none of these three figures replaces it.