## 4 Experiments
### Energy Consumption Results  
Energy consumption was obtained for each of the previously described test scenarios. Figures 4 and 5 show, respectively, the obtained results for ECDHE-RSA-AES256-GCM-SHA384 and ECDHE-ECDSA-AES256-GCM-SHA384 cipher suites. The x-axis represents the SoC frequency. For each of the frequencies, the security level increases from the left to the right. The actual RSA key size and used ECC curve is depicted on the legend of the figure. The bars in the same color correspond to security levels that are equivalent for RSA and ECC.  
To ease the comparison, Table 2 presents the energy reductions obtained when using the tested ECDSA and RSA cipher suites for different security levels and SoC frequencies. As can be observed, RSA is outperformed by ECDSA on every scenario. Even though the differences between RSA and ECDSA cipher suites decrease as the frequency increases, ECDSA consumes less energy than RSA for all tested configurations of SoC frequency and security level. In particular, when configured at a frequency of 240 MHz (the scenario in which less differences are obtained), ECDSA reduces RSA energy consumption by a 35.75% for an 80-bit security level, a 22.65% for a 112-bit security level and a remarkable 65.59% for a 128-bit security level.  
Regarding the impact of the frequency on the reported energy consumption, it can be concluded that the use of the highest available SoC frequency provides the bests results in terms of energy efficiency.  
Figure 4: Energy consumption grouped by SoC frequency for the different tested RSA key sizes.  
When comparing only the energy consumption of the ECDSA cipher suite, it can be seen that the curve secp224r1 performs worse than the curve secp256r1 when the SoC is configured to run at the maximum frequency. This because the NIST modulo \(p\) optimizations are platform and curve-dependent, which means that, even if a curve uses fewer bits (and as a consequence provides a lower security level), it can be outperformed (in terms of energy efficiency) by a more secure curve. Since such optimizations are based on software implementations, increasing SoC frequency will have a greater impact on the curves whose implementations are optimized. Thus, the relative performance between these two curves varies with the frequency. Specifically, it can be observed that at 80 MHz secp256r1 performs worst, at 160 MHz both curves present similar energy consumption and at 240 MHz the secp224r1 is outperformed by the more secure and more optimized secp256r1 curve.  
To verify that the secp256r1 curve actually outperforms secp224r1 due to the previously mentioned platform-specific optimizations, the same tests were performed at 240 MHz but disabling the NIST modulo \(p\) optimizations. The results are shown in Figure 6. As expected, the less secure secp224r1 curve presents lower energy consumption values than the secp256r1 curve, which confirms the hypothesis and thus illustrates the impact of the NIST modulo \(p\) optimizations.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Frequency (MHz)** & **80-bit** & **112-bit** & **128-bit** \\ \hline
80 & 39.64 & 42.76 & 68.21 \\
160 & 26.36 & 35.30 & 65.64 \\
240 & 35.75 & 22.65 & 65.59 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Energy consumption reduction (in percentage) of ECDSA in comparison to RSA.  
Figure 5: Energy consumption grouped by SoC frequency for the different tested ECDSA curves.  
Figure 6: Energy consumption of secp224r1 and secp256r1 curves without NIST modulo \(p\) optimizations (ESP32@240 MHz).