VAMPIRE

eBACS: ECRYPT Benchmarking of Cryptographic Systems

ECRYPT II

Measurements of public-key Diffie–Hellman secret-sharing systems, indexed by machine

There is a separate page with more information about each Diffie–Hellman system and each implementation. Designers and implementors interested in submitting new Diffie–Hellman systems and new implementations of existing systems should read the call for submissions.

What do the graphs and tables mean?

• Time to compute a shared secret, given one user's secret key and another user's public key.
• Time to compute a key pair.
• Space for a secret key.
• Space for a public key.
• Space for a shared secret.

Each computer also has a series of tables, five tables for each computer. The first table shows the time, in cycles, to generate a key pair. Each row of the table lists

• the first quartile of many time measurements,
• the median of many time measurements,
• the third quartile of many time measurements, and
• the name of the secret-sharing systems.

The computer name is linked to additional information about the implementations and compilers selected for benchmarking.

amd64; Zen (800f12); 2017 AMD EPYC 7601; 64 x 2200MHz; genji262, supercop-20171020

Cycles to generate a key pair quartile median quartile system 33352 34100 37290 curve2251 35068 36806 40018 ecfp256e 38720 38830 39072 gls254prot 36454 39182 45166 ecfp256h 37972? 39996? 49346? gls254 39622? 42878? 50226? ecfp256s 41074 43670 48488 ecfp256q 48048 48312 50886 k277taa 53724 53988 54472 k298 55330 56452 63624 gls1271 70202 70796 71566 k277mon 89980 90024 90090 kummer 128282 128304 128326 curve25519 158884 160270 175164 ecfp256i 175912 176088 176396 ed448goldilocks 174416 182182 203434 surf127eps 188320 190674 192610 sclaus1024 244376 244706 249348 nistp256 968682 977900 991562 sclaus2048 1093840 1100286 1111110 claus 1158476 1165252 1178056 ed521gs 1449272 1461196 1469688 nist521gs Cycles to compute a shared secret quartile median quartile system 34056 35860 42548 gls254 38676 38786 38852 gls254prot 48026? 48092? 61248? k277taa 53746 53834 53878 k298 70202 70290 71566 k277mon 89936 89980 90090 kummer 128128 128348 129580 curve25519 130130 130504 131318 curve2251 136224 139480 159632 gls1271 153516 153714 169642 ecfp256q 154396 154506 155518 ecfp256e 156486 156816 184426 ecfp256i 170456 172062 196196 surf127eps 181676 181786 181918 ecfp256h 191268 193512 195008 sclaus1024 200244 200354 200508 ecfp256s 472494 474672 477752 ed448goldilocks 526944 527912 539748 nistp256 967450 981464 989934 sclaus2048 1086206 1091530 1104334 claus 1158894 1165868 1175944 ed521gs 1452484 1462956 1469490 nist521gs Secret key bytes system 20 sclaus1024 28 sclaus2048 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 32 gls1271 48 kummer 48 surf127eps 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 gls254 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; Zen (800f11); 2017 AMD Ryzen 7 1700; 8 x 2994MHz; ryzen, supercop-20170904

Cycles to generate a key pair quartile median quartile system 38670 39210 41190 curve2251 44550 44760 45120 gls254 46080 46290 46350 gls254prot 64230 64260 64290 k277taa 66510 66630 66840 k298 82830 82950 82980 k277mon 103350 103410 103470 kummer 135510 135510 135540 curve25519 203070 205320 207660 surf127eps 213870 214020 214350 ed448goldilocks 350430 351060 351420 nistp256 1388910 1390620 1392090 ed521gs 1663530 1665720 1669350 nist521gs Cycles to compute a shared secret quartile median quartile system 43440 43470 43500 gls254 46050 46110 46230 gls254prot 64170 64200 64200 k277taa 66360 66390 66480 k298 82020 82140 82170 k277mon 103320 103380 103440 kummer 146910 147480 148890 curve25519 150270 150750 151290 curve2251 199290 200820 202980 surf127eps 540660 541860 542520 ed448goldilocks 623790 624300 624660 nistp256 1387410 1389660 1391250 ed521gs 1664850 1667730 1671570 nist521gs Secret key bytes system 32 curve2251 32 curve25519 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 56 ed448goldilocks 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 k298 144 ed521gs 144 nist521gs Shared secret bytes system 32 curve2251 32 curve25519 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs

amd64; KabyLake (906e9); 2017 Intel Xeon E3-1220 v6; 4 x 3000MHz; kizomba, supercop-20171218

Cycles to generate a key pair quartile median quartile system 37177 37663 38388 gls254 38713 38770 38941 gls254prot 39373 40313 41577 curve2251 43062 44014 44832 ecfp256e 46088 46422 47294 k277taa 46806 47881 49964 ecfp256h 47346 48230 49889 ecfp256s 49214 49347 49770 kummer 49184 50414 52105 ecfp256q 69857 70198 70847 k277mon 128135 129581 156278 curve25519 156400 157750 159926 ed448goldilocks 182665 183869 185883 surf127eps 182686 185359 187731 sclaus1024 193617 197177 200897 ecfp256i 238603 244778 256444 hector 316535 316855 317469 nistp256 519327 525756 533962 surf2113 828770 833482 840649 ed521gs 916198 926167 958917 sclaus2048 989905 1003194 1012893 claus 1003623 1010273 1016222 nist521gs Cycles to compute a shared secret quartile median quartile system 36028 36264 36734 gls254 38758 38924 39177 gls254prot 46189 46684 47369 k277taa 48518 48776 49000 kummer 69796 70111 70426 k277mon 137538 138754 139750 curve25519 145967 147684 149701 curve2251 177211 178710 180806 ecfp256e 179551 180645 182752 surf127eps 182186 185409 187909 sclaus1024 188208 189771 193030 ecfp256q 189562 191748 193849 ecfp256i 222845 224329 226310 ecfp256h 243288 245562 251340 ecfp256s 464266 466422 468683 ed448goldilocks 515178 522218 530061 surf2113 578301 583839 587959 nistp256 798800 812163 828192 hector 829615 834176 842613 ed521gs 912906 925648 983435 sclaus2048 978405 990278 1027685 claus 1000783 1002915 1007599 nist521gs Secret key bytes system 20 sclaus1024 28 sclaus2048 28 surf2113 29 hector 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 48 surf2113 56 ed448goldilocks 60 hector 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 kummer 48 surf127eps 48 surf2113 60 hector 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

x86; normally amd64; KabyLake (906e9); 2017 Intel Xeon E3-1220 v6; 4 x 3000MHz; kizomba, supercop-20171218

Cycles to generate a key pair quartile median quartile system 95125 95956 96943 k277mon 429972 432510 435885 curve25519 474812 476815 480022 kummer 627028 628982 636018 nistp256 1165798 1170879 1177280 ed448goldilocks Cycles to compute a shared secret quartile median quartile system 95736 96347 97147 k277mon 428657 430404 433111 curve25519 474105 475982 478035 kummer 2083617 2102992 2120734 nistp256 3777796 3788967 3796194 ed448goldilocks Secret key bytes system 32 curve25519 32 kummer 32 nistp256 48 k277mon 144 ed448goldilocks Public key bytes system 32 curve25519 48 kummer 56 ed448goldilocks 64 nistp256 80 k277mon Shared secret bytes system 32 curve25519 40 k277mon 48 kummer 64 ed448goldilocks 64 nistp256

amd64; SL+512x2 (50654); 2017 Intel Xeon Gold 6150; 18 x 2700MHz; manny1024, supercop-20170904

Cycles to generate a key pair quartile median quartile system 35846 36468 37368 gls254 37496 37532 37578 gls254prot 38200 38812 43474 curve2251 44762 44854 44912 k277taa 44638 45616 47390 ecfp256e 46430 47844 51736 ecfp256h 48126 48930 51172 ecfp256s 50950 51008 51126 k298 51338 52794 60152 ecfp256q 56708 56778 61264 kummer 60798 60874 60948 k277mon 126252 127094 127352 curve25519 178730 180396 182318 sclaus1024 194250 194592 194988 ed448goldilocks 196376 197216 197770 surf127eps 198096 199446 200970 ecfp256i 284370 284852 285362 nistp256 904142 917380 970450 sclaus2048 1064698 1070206 1079248 claus 1511902 1519730 1523824 ed521gs 1830512 1837766 1855930 nist521gs Cycles to compute a shared secret quartile median quartile system 34826 35040 35084 gls254 37430 37456 37492 gls254prot 44776 44810 44858 k277taa 50760 50852 50928 k298 56676 56742 61220 kummer 59494 59526 59560 k277mon 136180 136650 137372 curve25519 145356 145976 146144 curve2251 179620 182742 184014 sclaus1024 186030 186206 186422 ecfp256e 191674 192000 192444 surf127eps 193114 193376 193694 ecfp256q 195264 195476 195742 ecfp256i 224348 224534 224890 ecfp256h 249054 249288 249716 ecfp256s 503062 503288 503620 ed448goldilocks 579310 580438 583748 nistp256 900404 907680 984444 sclaus2048 1067904 1069148 1080216 claus 1509140 1518006 1521566 ed521gs 1823876 1834210 1839432 nist521gs Secret key bytes system 20 sclaus1024 28 sclaus2048 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; SL+512x2 (50654); 2017 Intel Xeon Gold 6130; 32 x 2100MHz; genji239, supercop-20171020

Cycles to generate a key pair quartile median quartile system 35854 36420 36810 gls254 37476 37518 37570 gls254prot 38142 38888 44272 curve2251 44808 44840 44884 k277taa 44006 45186 48418 ecfp256e 46450 49346 57038 ecfp256h 48424 49712 53260 ecfp256s 51244 51302 51404 k298 50596 52504 57102 ecfp256q 56684 56740 57126 kummer 59638 59788 59884 k277mon 125786 126850 127058 curve25519 178960 180542 182160 sclaus1024 189260 189642 195088 ed448goldilocks 196810 197938 208580 surf127eps 197312 198778 200254 ecfp256i 283280 283488 284052 nistp256 909320 936850 968592 sclaus2048 1067582 1080252 1102604 claus 1520346 1525502 1578742 ed521gs 1828812 1832772 1836130 nist521gs Cycles to compute a shared secret quartile median quartile system 34994 35028 35066 gls254 37400 37428 37460 gls254prot 44740 44778 44810 k277taa 51064 51186 51272 k298 56638 56692 56766 kummer 59526 59570 59832 k277mon 136166 136394 136518 curve25519 143902 146606 151802 curve2251 182314 183348 188508 sclaus1024 183174 185204 187048 ecfp256e 190000 191024 198248 surf127eps 191056 192580 192926 ecfp256q 193632 195144 195456 ecfp256i 224030 226220 226562 ecfp256h 246996 247428 249798 ecfp256s 501650 502352 510688 ed448goldilocks 581508 581870 586320 nistp256 895494 929078 976544 sclaus2048 1070188 1074918 1082448 claus 1517788 1520776 1526740 ed521gs 1828316 1831348 1834128 nist521gs Secret key bytes system 20 sclaus1024 28 sclaus2048 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; SL+512x2 (50654); 2017 Intel Core i7-7800X; 6 x 3500MHz; unstable; oki, supercop-20171218

Cycles to generate a key pair quartile median quartile system 25222 26284 28626 jacfp127i 26760 28640 30070 kumjacfp127g 28084 31172 32712 hecfp127i 32504 33044 33596 gls254 34264 34310 34358 gls254prot 33654 34586 35608 curve2251 30776 34590 37756 prjfp127i 32990 35394 36912 jacfp128bk 36268 37060 38758 ecfp256e 36960 38906 41180 hecfp128bk 37596 38988 41498 hecfp128i 38982 39994 43398 ecfp256s 41206 41248 41300 k277taa 41556 42672 46446 ecfp256q 40366 44390 46996 prjfp128bk 39272 44678 47392 hecfp128fkt 45464 45608 46266 kummer 39304? 46026? 50400? ecfp256h 50498 50628 50728 k298 65034 65086 65144 k277mon 71306 71380 71456 kumfp127g 101110 106292 106398 kumfp128g 110826 111194 111640 curve25519 117562 119324 121130 gls1271 135000 135216 135498 ed448goldilocks 166668 167466 168506 ecfp256i 284576 285212 285374 nistp256 742876 743278 744058 ed521gs 866278 866728 867154 nist521gs Cycles to compute a shared secret quartile median quartile system 31498 31758 31804 gls254 34176 34212 34250 gls254prot 41138 41178 41206 k277taa 44922 45166 45606 kummer 50506 51078 51158 k298 64968 65016 65068 k277mon 73386 73450 73534 kumfp127g 73426 73524 77256 kumjacfp127g 88406 88564 88754 jacfp128bk 105146 106026 106278 prjfp128bk 108556 108814 109052 hecfp128bk 105950 111376 111460 kumfp128g 112052 112262 112498 hecfp128fkt 116414 116602 116818 jacfp127i 119416 119760 120124 curve25519 127426 127672 127844 curve2251 150748 151142 151448 prjfp127i 153438 153626 153798 ecfp256e 154406 154552 154680 hecfp127i 162924 163050 163232 ecfp256q 164036 164222 168120 ecfp256i 191688 191932 239230 ecfp256h 208902 210542 210726 ecfp256s 223900 224158 224352 hecfp128i 264876 266438 268024 gls1271 404816 405272 406222 ed448goldilocks 510762 514484 514748 nistp256 741760 741888 742130 ed521gs 866106 866434 866994 nist521gs Secret key bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 32 hecfp127i 32 hecfp128bk 32 hecfp128fkt 32 hecfp128i 32 jacfp127i 32 jacfp128bk 32 k298 32 kumfp127g 32 kumfp128g 32 kumjacfp127g 32 kummer 32 nistp256 32 prjfp127i 32 prjfp128bk 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks Public key bytes system 32 curve2251 32 curve25519 32 gls1271 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 80 k277mon 80 k277taa 96 ecfp256i 96 k298 144 ed521gs 144 nist521gs Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 64 ed448goldilocks 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 72 ed521gs 72 nist521gs

amd64; KnLanding (50671); 2016 Intel Xeon Phi 7250; 68 x 1400MHz; unstable; pluton1mn, supercop-20160806

Cycles to generate a key pair quartile median quartile system 91686 92386 93730 gls254 90720 92778 94892 curve2251 96026 96068 96096 kummer 105980 107142 108640 ecfp256e 117474 118594 122304 ecfp256h 118566 118608 118678 gls254prot 118286 120078 122514 ecfp256s 125762 129136 132034 ecfp256q 282674 282758 286748 curve25519 523558 525000 541646 nistp256 590534 597660 611618 ecfp256i 675052 684306 693294 surf127eps 805798 817810 824642 ed448goldilocks 948892 968702 975870 surf2113 1701224 1717352 1738450 sclaus1024 3985464 3990098 4003986 ed521gs 4786656 4802602 4917626 nist521gs 6990004 6996920 7010626 claus 8350034 8411396 8490902 sclaus2048 Cycles to compute a shared secret quartile median quartile system 77644 77728 78078 gls254 83930 83930 84014 kummer 106092 106092 106120 gls254prot 254604 254716 255486 curve2251 282114 282128 287812 curve25519 551754 554848 574518 ecfp256e 588686 590002 609742 ecfp256i 578606 590268 604226 ecfp256q 656026 664384 672140 surf127eps 706034 723534 728826 ecfp256h 711564 729302 734412 ecfp256s 932330 955514 958734 surf2113 1690430 1694154 1699600 sclaus1024 1812342 1827756 1841126 nistp256 2824710 2828630 2834846 ed448goldilocks 3935554 3941126 3946740 ed521gs 4747624 4759748 4848046 nist521gs 6951560 6957230 6962508 claus 8517362 8522654 8529094 sclaus2048 Secret key bytes system 20 sclaus1024 28 sclaus2048 28 surf2113 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 32 kummer 32 nistp256 32 surf127eps 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 48 surf2113 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 96 ecfp256i 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 48 kummer 48 surf127eps 48 surf2113 64 ed448goldilocks 64 gls254 64 gls254prot 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; KnLanding (50671); 2016 Intel Xeon Phi 7210; 64 x 1300MHz; genji154, supercop-20170228

Cycles to generate a key pair quartile median quartile system 80015 80184 80548 gls254 94796 96915 97084 kummer 98761 98800 99281 k277taa 96434 100100 102687 curve2251 104533 105742 108771 kumjacfp127g 106145 107614 109083 jacfp127i 108940 109928 112255 prjfp127i 109148 110747 114686 hecfp127i 114283 115362 117065 ecfp256e 119535 119717 120926 k298 126971 127023 142155 gls254prot 128206 128206 128622 k277mon 129142 130793 133029 ecfp256s 130572 132236 135590 ecfp256h 136175 138229 142220 ecfp256q 143338 144560 152750 jacfp128bk 159978 161265 171665 hecfp128bk 160771 161876 167492 prjfp128bk 162058 163592 170313 hecfp128fkt 163436 164827 169377 hecfp128i 188032 190736 194909 gls1271 300248 300495 318838 curve25519 338546 339833 356005 kumfp127g 537290 556465 590837 hector 561938 568334 582738 nistp256 582504 586755 599287 kumfp128g 633113 646568 660621 ecfp256i 709774 721058 728091 surf127eps 730288 740441 766792 ed448goldilocks 1028599 1039337 1046825 surf2113 1858909 1886105 1927380 sclaus1024 4311814 4321057 4338438 ed521gs 5180097 5210283 5261685 nist521gs 7616661 7675070 7772817 claus 8972717 9026225 9091264 sclaus2048 Cycles to compute a shared secret quartile median quartile system 66742 66768 66781 gls254 80145 80158 80509 k277taa 83525 83564 85852 kummer 107237 107367 107523 k298 109564 109577 109629 k277mon 113633 113646 137124 gls254prot 272857 273455 277745 curve2251 300781 301444 320255 curve25519 342368 343629 359866 kumfp127g 344903 345826 362115 kumjacfp127g 444080 445952 467766 gls1271 452647 453310 476879 jacfp128bk 522548 523172 548704 prjfp128bk 526370 527085 548236 hecfp128bk 545402 551122 571415 hecfp128fkt 564382 570947 594698 jacfp127i 591448 595647 616226 ecfp256e 597831 600184 613392 kumfp128g 620308 637117 646815 ecfp256q 629967 639860 655382 ecfp256i 658840 680745 689195 prjfp127i 676195 697541 707759 hecfp127i 695916 706563 712088 surf127eps 762307 780520 790010 ecfp256h 767169 785564 794378 ecfp256s 1021111 1025856 1039402 surf2113 1100528 1112943 1121549 hecfp128i 1671228 1677689 1690533 hector 1841606 1855633 1887392 sclaus1024 1938443 1946048 1953380 nistp256 2266550 2277158 2301273 ed448goldilocks 4260919 4270955 4281446 ed521gs 5137925 5165290 5193188 nist521gs 7557290 7574736 7673575 claus 9138701 9143719 9151662 sclaus2048 Secret key bytes system 20 sclaus1024 28 sclaus2048 28 surf2113 29 hector 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 32 hecfp127i 32 hecfp128bk 32 hecfp128fkt 32 hecfp128i 32 jacfp127i 32 jacfp128bk 32 k298 32 kumfp127g 32 kumfp128g 32 kumjacfp127g 32 kummer 32 nistp256 32 prjfp127i 32 prjfp128bk 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 32 gls1271 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 48 surf127eps 48 surf2113 56 ed448goldilocks 60 hector 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 40 k277mon 40 k277taa 48 k298 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 48 surf127eps 48 surf2113 60 hector 64 ed448goldilocks 64 gls254prot 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; BW+AES (406f1); 2016 Intel Xeon E5-2680 v4; 28 x 2400MHz; genji122, supercop-20171020

Cycles to generate a key pair quartile median quartile system 40124 40752 44348 curve2251 40788 41128 41496 gls254 42756 42820 42864 gls254prot 45744 46720 49228 ecfp256e 49120 50688 55296 ecfp256s 47564 50744 57432 ecfp256h 52256 53948 58036 ecfp256q 54312 54396 54480 k277taa 57580 57704 57832 k298 67984 68064 68176 kummer 77512 77568 77668 k277mon 143580 143728 145544 curve25519 193172 194860 196884 sclaus1024 196452 196664 197032 ed448goldilocks 207928 209060 210560 ecfp256i 210112 210760 211488 surf127eps 299920 300620 302476 nistp256 958208 969800 1026260 sclaus2048 1144388 1147516 1150848 claus 1761972 1764620 1769060 ed521gs 2064632 2066972 2071184 nist521gs Cycles to compute a shared secret quartile median quartile system 39724 39780 39864 gls254 42588 42648 42688 gls254prot 54180 54264 54360 k277taa 57288 57396 57516 k298 67884 67948 68036 kummer 77356 77444 77532 k277mon 143612 143760 145644 curve25519 152788 152972 153860 curve2251 193056 193140 193288 ecfp256e 195648 196716 198460 sclaus1024 201512 201616 201732 ecfp256q 203360 205192 205928 surf127eps 205252 205372 205516 ecfp256i 233468 233580 233756 ecfp256h 257596 257740 257964 ecfp256s 512364 513380 521928 ed448goldilocks 630516 632544 633828 nistp256 966688 973552 1034480 sclaus2048 1143276 1145836 1148036 claus 1757956 1760872 1764888 ed521gs 2063180 2066008 2071792 nist521gs Secret key bytes system 20 sclaus1024 28 sclaus2048 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; BW+AES (406f1); 2016 Intel Xeon E5-2680 v4; 14 x 2400MHz; manny357, supercop-20170228

Cycles to generate a key pair quartile median quartile system 30848 31532 33524 jacfp127i 31808 32992 35904 kumjacfp127g 36272 37508 39752 hecfp127i 38812? 40412? 56704? prjfp127i 39412 40572 41712 jacfp128bk 42672 43356 45320 ecfp256e 43800 44704 47012 hecfp128bk 43880 45016 47656 hecfp128fkt 44684 46236 50852 prjfp128bk 45500 46700 52840 ecfp256h 46584 47836 52240 ecfp256s 47772 48072 50720 curve2251 46288? 48168? 64588? hecfp128i 47556 48420 48996 gls254 48424 49256 53108 ecfp256q 64400 64448 64520 gls254prot 65816 65876 65932 k277taa 67964 68108 68252 k298 71232 71288 71352 kummer 84152 84268 84416 kumfp127g 83640 85088 86172 gls1271 86120 86204 88828 k277mon 130344 130596 130920 kumfp128g 152672 152792 152948 curve25519 183644 183992 184328 ed448goldilocks 202200 203084 203908 surf127eps 199736 203604 207808 ecfp256i 310768 311100 311568 nistp256 562588 564152 567308 surf2113 932744 936760 944504 ed521gs 943132 973416 1014612 hector 1043028 1049828 1063196 nist521gs 1653260 1666660 1725184 claus Cycles to compute a shared secret quartile median quartile system 38688 38744 38784 gls254 53000 53048 53100 k277taa 55864 55916 55972 gls254prot 57416 57540 57664 k298 63796 63868 63988 kummer 73336 73404 76000 k277mon 86308 86472 86912 kumfp127g 88648 89416 90520 kumjacfp127g 108584 108776 109032 jacfp128bk 128920 129248 138860 prjfp128bk 131424 131680 132120 hecfp128bk 135692 136012 136448 hecfp128fkt 135828 136344 136560 kumfp128g 144740 144868 144980 curve25519 153312 153368 153448 curve2251 162760 162916 163144 jacfp127i 183308 183468 183676 ecfp256e 186680 187076 196304 gls1271 191176 191852 192752 prjfp127i 191848 191964 192160 ecfp256q 192416 192684 193244 surf127eps 194644 194940 200344 hecfp127i 195724 195940 205784 ecfp256i 229308 229492 238220 ecfp256h 247816 247964 248152 ecfp256s 270308 270548 270868 hecfp128i 529064 529392 537124 ed448goldilocks 553888 554048 561240 surf2113 611440 613820 619948 nistp256 899596 902528 910444 ed521gs 1016296 1016972 1024784 nist521gs 1643900 1665128 1734604 claus 3014244 3037260 3076844 hector Secret key bytes system 28 surf2113 29 hector 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 32 hecfp127i 32 hecfp128bk 32 hecfp128fkt 32 hecfp128i 32 jacfp127i 32 jacfp128bk 32 k298 32 kumfp127g 32 kumfp128g 32 kumjacfp127g 32 kummer 32 nistp256 32 prjfp127i 32 prjfp128bk 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 32 gls1271 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 48 surf127eps 48 surf2113 56 ed448goldilocks 60 hector 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 144 ed521gs 144 nist521gs Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 40 k277mon 40 k277taa 48 k298 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 48 surf127eps 48 surf2113 60 hector 64 ed448goldilocks 64 gls254prot 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 72 ed521gs 72 nist521gs 128 claus

amd64; BW+AES (406f1); 2016 Intel Xeon E5-2609 v4; 8 x 1700MHz; bolero, supercop-20171218

Cycles to generate a key pair quartile median quartile system 37660 37844 37956 gls254 39140 39328 41064 curve2251 39400 39456 39516 gls254prot 41948 42592 44220 ecfp256e 44440 45100 47160 ecfp256h 46016 46756 48972 ecfp256s 48000 48648 50372 ecfp256q 50984 51064 51180 k277taa 60796 60864 60904 kummer 74536 74616 75232 k277mon 80724 81720 82368 gls1271 142332 142456 142604 curve25519 155200 155668 157068 ed448goldilocks 192272 193888 195444 sclaus1024 196628 197440 198168 surf127eps 198228 199220 200484 ecfp256i 328220 328560 328796 nistp256 581448 583508 584604 surf2113 915052 916860 919408 ed521gs 954824 963028 975432 sclaus2048 992860 993424 994424 claus 1063636 1064748 1066136 nist521gs Cycles to compute a shared secret quartile median quartile system 36244 36420 36468 gls254 39316 39344 39380 gls254prot 50720 50832 50948 k277taa 60700 60780 60868 kummer 74416 74512 75104 k277mon 142316 142432 142516 curve25519 153616 153716 153820 curve2251 184164 184272 184416 ecfp256e 186868 190436 191540 surf127eps 192724 192840 192984 ecfp256q 195168 195288 195424 ecfp256i 192528 196992 197600 sclaus1024 200240 200600 202596 gls1271 229824 229948 230100 ecfp256h 247908 248056 248228 ecfp256s 459556 460020 464824 ed448goldilocks 577344 581624 582092 surf2113 614924 615500 616528 nistp256 914624 915380 915956 ed521gs 953996 961632 975576 sclaus2048 981012 981612 985088 claus 1063480 1064504 1065880 nist521gs Secret key bytes system 20 sclaus1024 28 sclaus2048 28 surf2113 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 32 gls1271 48 kummer 48 surf127eps 48 surf2113 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 kummer 48 surf127eps 48 surf2113 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

x86; normally amd64; BW+AES (406f1); 2016 Intel Xeon E5-2609 v4; 8 x 1700MHz; bolero, supercop-20171218

Cycles to generate a key pair quartile median quartile system 104880 105004 105124 k277mon 409076 409280 409492 curve25519 496532 496604 496676 kummer 637172 637452 637736 nistp256 1216752 1217180 1217932 ed448goldilocks Cycles to compute a shared secret quartile median quartile system 104692 104804 104936 k277mon 410016 410352 410484 curve25519 496412 496544 496772 kummer 2151272 2154620 2158456 nistp256 4035768 4039800 4042272 ed448goldilocks Secret key bytes system 32 curve25519 32 kummer 32 nistp256 48 k277mon 144 ed448goldilocks Public key bytes system 32 curve25519 48 kummer 56 ed448goldilocks 64 nistp256 80 k277mon Shared secret bytes system 32 curve25519 40 k277mon 48 kummer 64 ed448goldilocks 64 nistp256

aarch64; Cortex-A72 (418fd080); 2015 Mediatek MT8173; 2 x 2100MHz; a72, supercop-20170904

Cycles to generate a key pair quartile median quartile system 231882 231889 231901 kummer 365386 365386 365401 curve25519 383230 383243 383271 nistp256 486566 488239 489933 surf127eps 620830 625505 632409 sclaus1024 1874931 1874961 1880218 ed521gs 2408941 2409141 2414426 nist521gs 3092004 3112034 3133330 sclaus2048 3757813 3765976 3773376 claus Cycles to compute a shared secret quartile median quartile system 234069 234072 234084 kummer 365822 365823 365825 curve25519 472277 473396 474889 surf127eps 617908 626040 628777 sclaus1024 1346660 1346679 1346805 nistp256 1874727 1874728 1874795 ed521gs 2407640 2407659 2407821 nist521gs 3077550 3092960 3106562 sclaus2048 3736966 3739582 3760067 claus Secret key bytes system 20 sclaus1024 28 sclaus2048 32 curve25519 32 kummer 32 nistp256 32 surf127eps 104 nist521gs 130 ed521gs 256 claus Public key bytes system 32 curve25519 48 kummer 48 surf127eps 64 nistp256 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve25519 48 kummer 48 surf127eps 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

aarch64; Cortex-A57 (418fd071); 2015 NVIDIA Tegra X1; 4 x 1734MHz; jetsontx1, supercop-20170904

Cycles to generate a key pair quartile median quartile system 232273 232725 232884 kummer 358682 358697 358775 curve25519 366886 366925 366992 nistp256 444793 448299 450218 surf127eps 628293 635816 641521 sclaus1024 1849645 1850460 1860685 ed521gs 2326935 2328231 2337400 nist521gs 3158066 3182950 3203570 sclaus2048 3778572 3787553 3799367 claus Cycles to compute a shared secret quartile median quartile system 232186 232436 232850 kummer 358608 358611 358611 curve25519 439997 443762 445480 surf127eps 636462 637323 642331 sclaus1024 1260206 1260223 1260414 nistp256 1849309 1849327 1858150 ed521gs 2326748 2327765 2337042 nist521gs 3171295 3192903 3215137 sclaus2048 3775761 3783696 3787541 claus Secret key bytes system 20 sclaus1024 28 sclaus2048 32 curve25519 32 kummer 32 nistp256 32 surf127eps 104 nist521gs 130 ed521gs 256 claus Public key bytes system 32 curve25519 48 kummer 48 surf127eps 64 nistp256 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve25519 48 kummer 48 surf127eps 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

aarch64; Cortex-A57 (418fd071); 2015 NVIDIA Tegra X1; 4 x 1734MHz; lionheart30, supercop-20161026

Cycles to generate a key pair quartile median quartile system 245555 245587 245806 kummer 372415 372418 373175 curve25519 393267 393541 393556 nistp256 517636 518620 522321 ed448goldilocks 1921543 1923084 1925078 ed521gs 2401387 2402603 2403152 nist521gs 9797357 9810335 9823942 claus Cycles to compute a shared secret quartile median quartile system 237028 237437 237723 kummer 364506 364556 364561 curve25519 1286087 1286098 1286102 nistp256 1571043 1571837 1571840 ed448goldilocks 1888396 1888429 1889043 ed521gs 2375025 2375693 2376697 nist521gs 9718579 9731965 9745990 claus Secret key bytes system 32 curve25519 32 kummer 32 nistp256 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve25519 48 kummer 56 ed448goldilocks 64 nistp256 128 claus 144 ed521gs 144 nist521gs Shared secret bytes system 32 curve25519 48 kummer 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus