Elliptic curves - operations in larger groups - performance According to my measurements and to this work, it seems that operations, for example scalar multiplication, are more expensive in larger groups. If I have, for example, an 80-bit elliptic curve and an 384-bit elliptic curve, then the difference is very big:


80-bit curve: 10ms per 1 multiplication on average
384-bit curve: 501ms per 1 multiplication on average


I don't know if it's related, but the method for multiplication is probably wNAF.

Question: Why basic operations are more expensive on larger groups?
There are many different flavors of elliptic curves and coordinate systems for them with different costs for computing addition or scalar multiplication.  You can find cost estimates for many of these at the Explicit-Formulas Database (EFD), and measurements from SUPERCOP at https://bench.cr.yp.to/.

Certain curves like Curve25519 in Montgomery form $y^2 = x^3 + 486662 x^2 + x$ were designed to admit fast $x$-restricted scalar multiplication, i.e. to compute $x([n]P)$ given $n$ and $x(P)$, as is sufficient for applications like Diffie–Hellman; software to compute it will consequently run much faster than software to compute scalar multiplication of a generic short Weierstrass curve of comparable size.  Certain curves also admit an Edwards or twisted Edwards form like $-x^2 + y^2 = 1 - (121665/121666) x^2 y^2$, which also admits much faster addition formulas than generic short Weierstrass curves, but only those with cofactor at least 4 can have this form.

The cost estimates of the EFD are all written in terms of numbers of additions, multiplications, etc., in the underlying field $\mathbb F_q$.  Certain fields like $\mathbb F_{2^{255} - 19}$ are designed to admit constant-factor speedups for fast arithmetic in software by being just below a power of two, but largely, the number of bit operations to compute addition in $\mathbb F_q$ grows as $O(\log q)$, and to compute multiplication, $O(\log^2 q)$, or $O(\log^{\log_2 3} q)$ if you use Karatsuba's algorithm, etc.

There are no substantive shortcuts around these bit operation costs in general.  Of course, in special cases, curves may admit a fast endomorphism like Koblitz curves, FourQ, etc., which can be used to speed up scalar multiplication on those curves.

Finally, Hasse's theorem bounds the distance between the size $q$ of the underlying field and the size $\ell$ of the group, which is also the size of the scalar ring.  So for larger fields, the scalars may be larger (unless for some reason you're safely working in a subgroup), and to have larger scalars, the field must be larger.  Security is generically limited by the cost $O(\sqrt\ell)$ of Pollard's $\rho$ to compute discrete logs in the group, so if you want Pollard's $\rho$ to cost ${\sim}2^{128}$ bit operations you must choose a group with $\ell \sim 2^{256}$.