Performance Overhead of SM2 vs. RSA in Spring Boot

Abstract

As the national strategy for autonomous and controllable information security continues to advance, the process of replacing imported technologies with domestic alternatives in the field of critical information infrastructure is gradually accelerating. Traditional RSA algorithms incur significant computational overhead at high security levels (such as 2048 bits), making them prone to becoming performance bottlenecks in high-concurrency web scenarios. In contrast, the Chinese SM2 algorithm, based on the elliptic curve discrete logarithm problem, requires a key length that is only one-eighth that of RSA at equivalent security levels, offering higher theoretical efficiency. However, existing research has largely focused on comparing the mathematical principles of the algorithms themselves, with a lack of quantitative empirical data from real-world industrial-grade web development frameworks. In particular, the impact of the Spring Boot framework’s core mechanisms (such as auto-configuration, bean management and request interceptors) on algorithm execution efficiency has not yet been systematically studied. Consequently, this study utilises the Spring Boot framework and employs a method involving control variables and stratified experiments to quantitatively compare the performance of SM2 and RSA in secure communication scenarios. The aim is to supplement the theoretical data on domestic cryptographic algorithms in the field of web development, thereby providing developers with quantifiable reference criteria and practical engineering guidance for selecting and applying these algorithms in real-world projects.