VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

General information:	Introduction	eBASH	eBASC	eBAEAD	eBATS	SUPERCOP	XBX	Computers

How to submit new software:	Tips	hash	stream	aead	dh	kem	encrypt	sign

List of primitives measured:	lwc	sha3	hash	stream	lwc	caesar	aead	dh	kem	encrypt	sign

Measurements indexed by machine:	lwc	sha3	hash	stream	lwc	caesar	aead	dh	kem	encrypt	sign

List of subroutines:	verify	decode	encode	sort	core	hashblocks	scalarmult

Measurements of public-key Diffie–Hellman secret-sharing systems, indexed by machine

eBATS (ECRYPT Benchmarking of Asymmetric Systems) is a project to measure the performance of public-key systems. This page presents the benchmark results collected in eBATS for public-key Diffie–Hellman secret-sharing systems:

Time (cycles) to generate a key pair: a secret key and a corresponding public key.
Time to compute a shared secret, given one user's secret key and another user's public key.
Space (bytes) for a secret key.
Space for a public key.
Space for a shared secret.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation.

Each computer name is linked to additional information about the implementations and compilers selected for benchmarking.

There is a separate page with more information about each Diffie–Hellman system and each implementation. Designers and implementors interested in submitting new Diffie–Hellman systems and new implementations of existing systems should read the call for submissions.

Sizes across machines

Secret key
bytes	system
20	sclaus1024
28	sclaus2048
28	surf2113
29	hector
32	curve2251
32	curve25519
32	ecfp256e
32	ecfp256h
32	ecfp256i
32	ecfp256q
32	ecfp256s
32	gls1271
32	gls254
32	gls254prot
32	hecfp127i
32	hecfp128bk
32	hecfp128fkt
32	hecfp128i
32	jacfp127i
32	jacfp128bk
32	k298
32	kumfp127g
32	kumfp128g
32	kumjacfp127g
32	kummer
32	nistp256
32	prjfp127i
32	prjfp128bk
32	surf127eps
48	k277mon
48	k277taa
104	nist521gs
130	ed521gs
144	ed448goldilocks
256	claus

Public key
bytes	system
32	curve2251
32	curve25519
32	gls1271
48	kumfp127g
48	kumfp128g
48	kumjacfp127g
48	kummer
48	surf127eps
48	surf2113
56	ed448goldilocks
60	hector
64	ecfp256e
64	ecfp256h
64	ecfp256q
64	ecfp256s
64	gls254
64	gls254prot
64	hecfp127i
64	hecfp128bk
64	hecfp128fkt
64	hecfp128i
64	jacfp127i
64	jacfp128bk
64	nistp256
64	prjfp127i
64	prjfp128bk
80	k277mon
80	k277taa
96	ecfp256i
96	k298
128	claus
128	sclaus1024
144	ed521gs
144	nist521gs
256	sclaus2048

Shared secret
bytes	system
32	curve2251
32	curve25519
32	ecfp256e
32	ecfp256h
32	ecfp256i
32	ecfp256q
32	ecfp256s
32	gls1271
32	gls254prot
32..32..64	gls254
40	k277mon
40	k277taa
48	k298
48	kumfp127g
48	kumfp128g
48	kumjacfp127g
48	kummer
48	surf127eps
48	surf2113
60	hector
64	ed448goldilocks
64	hecfp127i
64	hecfp128bk
64	hecfp128fkt
64	hecfp128i
64	jacfp127i
64	jacfp128bk
64	nistp256
64	prjfp127i
64	prjfp128bk
72	ed521gs
72	nist521gs
128	claus
128	sclaus1024
256	sclaus2048

aarch64; Firestorm (610f0230); 2020 Apple M1; 4 x 3200MHz; unstable; `minimac`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
103596?	106662?	191459?	T: kummer
106662?	107063?	196792?	T: curve25519
159594?	159860?	261590?	T: nistp256
489848?	492114?	801969?	T: ed521gs
667441?	668907?	980761?	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
103063?	103996?	168927?	T: kummer
106662?	107062?	174526?	T: curve25519
424383?	424783?	622109?	T: nistp256
489847?	490248?	656374?	T: ed521gs
666774	667574	780236	T: nist521gs

amd64; Zen3 (a20f10); 2020 AMD Ryzen 9 5950X; 16 x 3400MHz; `zen3`, `supercop-20220213`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
33550	34336	37499	T: curve2251
36365	36513	37501	T: gls254
37936	37937	37952	T: gls254prot
46733	46795	46877	T: k277taa
49095	49145	49182	T: kummer
53802	54362	54972	T: gls1271
62217	62354	62808	T: k298
73089	73203	73278	T: k277mon
102285	102373	102495	T: curve25519
140529	141187	141634	T: surf127eps
159195	159496	159723	T: ed448goldilocks
207217	208665	210377	T: sclaus1024
222820	223237	223320	T: nistp256
367798	369470	370460	T: surf2113
716599	719778	729310	T: ed521gs
880981	882015	884294	T: nist521gs
1019127	1019797	1023602	T: claus
1013728	1021401	1029771	T: sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
35264	35341	35442	T: gls254
37854	37885	37886	T: gls254prot
46634	46717	46804	T: k277taa
49103	49139	49166	T: kummer
62092	62181	62313	T: k298
73031	73086	73130	T: k277mon
110825	110904	110991	T: curve25519
129784	130071	131187	T: curve2251
129270	130535	131907	T: gls1271
137060	138423	138483	T: surf127eps
208043	208798	210458	T: sclaus1024
364367	365479	366016	T: surf2113
525993	526466	527032	T: ed448goldilocks
600802	602448	603146	T: nistp256
716085	717688	727485	T: ed521gs
883003	884791	887358	T: nist521gs
1016339	1017224	1018546	T: claus
1001141	1028056	1029316	T: sclaus2048

amd64; TigerLake (806c1); 2020 Intel Core i7-1165G7; 4 x 2800MHz; unstable; `pascalinspiron75062n1`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
34713	35424	35982	T: gls254
44020?	44122?	62494?	T: k277taa
40251?	48857?	52389?	T: curve2251
40731?	55280?	55846?	T: gls254prot
48486?	59179?	66204?	T: kummer
66531?	66652?	90521?	T: k277mon
68058	68503	70155	T: k298
85612?	143849?	148600?	T: gls1271
121691?	167095?	168975?	T: curve25519
201555?	202390?	349382?	T: ed448goldilocks
413114?	682870?	684613?	T: nistp256
817128?	820394?	1420902?	T: ed521gs
1057456	1080821	1081832	T: claus
966532?	1605510?	1671940?	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
33932	34009	34088	T: gls254
43953?	44086?	62441?	T: k277taa
40617?	55032?	55657?	T: gls254prot
48345?	58817?	66103?	T: kummer
66462?	66666?	90539?	T: k277mon
67516	68008	69718	T: k298
142970?	165794?	180848?	T: curve2251
130971?	181117?	181710?	T: curve25519
193504?	325432?	352758?	T: gls1271
618730?	621789?	1130834?	T: ed448goldilocks
824258?	827097?	1419341?	T: ed521gs
1050336	1052075	1074540	T: claus
909142?	1420240?	1423559?	T: nistp256
975478?	1596616?	1671468?	T: nist521gs

amd64; IceLake (706e5); 2020 Intel Core i5-1030NG7; 4 x 1100MHz; `icelake`, `supercop-20200826`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
33522	33731	34144	T: gls254
35610	35688	35857	T: gls254prot
42674	42790	43079	T: k277taa
49133	49284	49590	T: kummer
48964	49406	49890	T: k298
64155	64226	64474	T: k277mon
139430	139922	140420	T: ed448goldilocks
146164	146617	147668	T: curve25519
177831	179075	180402	T: surf127eps
216697	219367	222743	T: sclaus1024
236243	238668	241547	T: nistp256
415881	418845	426337	T: surf2113
600080	607273	614920	T: curve2251
803594	809836	813477	T: ed521gs
989223	994163	999637	T: nist521gs
1118410	1128046	1156630	T: sclaus2048
1302784	1309263	1319571	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
32803	33007	33439	T: gls254
35509	35604	35832	T: gls254prot
42560	42769	43190	T: k277taa
49070	49244	49472	T: kummer
48887	49310	49909	T: k298
64094	64243	64566	T: k277mon
146537	147229	148198	T: curve25519
171622	173237	174793	T: surf127eps
217221	219534	222323	T: sclaus1024
412044	414424	419682	T: surf2113
465488	467029	469786	T: ed448goldilocks
592171	597431	608049	T: curve2251
595051	598639	602985	T: nistp256
802592	807016	811640	T: ed521gs
996844	1002068	1067900	T: nist521gs
1114489	1125403	1153790	T: sclaus2048
1302809	1307768	1315341	T: claus

aarch64; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; `pi4b`, `supercop-20220506`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
248148	249139	249173	T: kummer
349461	349696	350531	T: curve25519
369172	373685	373896	T: nistp256
422551	424503	426517	T: surf127eps
597032	603021	610129	T: sclaus1024
1947604	1953396	1987683	T: ed521gs
2400781	2406447	2426148	T: nist521gs
3003804	3018915	3043558	T: sclaus2048
3603716	3617692	3633916	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
248098	248294	248622	T: kummer
349351	350485	351136	T: curve25519
406145	407608	411163	T: surf127eps
571389	597937	603751	T: sclaus1024
1306069	1306237	1306937	T: nistp256
1944505	1946892	1961978	T: ed521gs
2401778	2402092	2411736	T: nist521gs
3026179	3047105	3057524	T: sclaus2048
3607736	3614371	3639519	T: claus

ppc64; POWER9 (004e1203); 2019? IBM 02CY642; 22 x 3800MHz; `power9`, `supercop-20210326`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
153845	153989	154567	T: curve25519
219096	221593	236369	T: sclaus1024
233761	234189	239890	T: kummer
324530	324909	325258	T: nistp256
380449	381816	383291	T: surf127eps
939493	947857	967568	T: sclaus2048
990417	991668	1005008	T: ed521gs
1260583	1261379	1293254	T: nist521gs
1300860	1350527	1401659	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
153687	153861	157772	T: curve25519
224841	226275	237648	T: sclaus1024
233518	235179	243935	T: kummer
368934	370377	372535	T: surf127eps
876979	877598	878065	T: nistp256
949847	953575	968856	T: sclaus2048
989193	989902	1006598	T: ed521gs
1260082	1260694	1262851	T: nist521gs
1301062	1351044	1401612	T: claus

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; `colossus6`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
20205?	23107?	26212?	T: hecfp127i
24525	27045	30307	T: jacfp128bk
22860?	28553?	31410?	T: jacfp127i
27945	29745	33840	T: curve2251
27405	29925	32895	T: ecfp256e
30082	30375	30735	T: gls254
30397	30420	30442	T: gls254prot
27630	30555	32895	T: kumjacfp127g
24615?	30713?	34020?	T: prjfp127i
30127?	31342?	39713?	T: hecfp128fkt
29273	31523	34493	T: hecfp128bk
31275?	33907?	39262?	T: ecfp256s
30915?	35123?	42075?	T: ecfp256h
32760	36292	39758	T: hecfp128i
36968	37012	37057	T: k277taa
31433?	37372?	40410?	T: prjfp128bk
34650?	39105?	45608?	T: ecfp256q
38880	39172	39195	T: kummer
42863	43583	44370	T: gls1271
43942	44528	46395	T: k298
57690	57690	57758	T: kumfp127g
58860	58860	59310	T: k277mon
75713	75758	75870	T: kumfp128g
93780	94297	94635	T: curve25519
100058	100620	101542	T: surf127eps
109597	109958	113400	T: ed448goldilocks
109597	110385	111330	T: ecfp256i
114255	116370	123750	T: sclaus1024
148297	153675	161032	T: hector
164115	165510	170685	T: nistp256
367988	369720	372420	T: surf2113
550237	551745	556538	T: ed521gs
585697	590580	596588	T: sclaus2048
652050	652522	658372	T: nist521gs
678690	682830	689355	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
28710	28755	28868	T: gls254
30330	30330	30330	T: gls254prot
36653	36923	37215	T: k277taa
38902	39150	39172	T: kummer
43785	43807	43830	T: k298
58657	58658	59107	T: kumfp127g
58770	58815	59625	T: jacfp128bk
58815	58815	59265	T: k277mon
59153	59288	59940	T: kumjacfp127g
69570	69615	70178	T: prjfp128bk
71167	71348	71730	T: hecfp128bk
73643	73733	73935	T: hecfp128fkt
79672	79673	80167	T: kumfp128g
90000	90315	91013	T: jacfp127i
93780	94342	94590	T: curve25519
97110	97312	97920	T: surf127eps
101160	101183	101812	T: ecfp256e
104310	105300	108112	T: gls1271
106493	106830	107325	T: ecfp256i
107775	107933	108720	T: curve2251
110677	110767	111555	T: ecfp256q
110723	110835	112095	T: prjfp127i
112995	113062	113490	T: hecfp127i
115808	116303	117382	T: sclaus1024
124605	124740	125662	T: ecfp256h
147622	147735	148725	T: ecfp256s
156398	156555	156623	T: hecfp128i
336465	337275	339795	T: ed448goldilocks
369292	369788	372442	T: surf2113
402075	402817	405608	T: nistp256
512842	515498	525915	T: hector
548887	549562	551115	T: ed521gs
583065	586597	590220	T: sclaus2048
647505	648517	649778	T: nist521gs
677453	679455	685845	T: claus

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; `colossus7`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
25695	26460	27630	T: jacfp127i
25492	26752	28305	T: prjfp127i
29430	30352	33142	T: curve2251
29610	31410	33030	T: jacfp128bk
29970	31725	32625	T: hecfp127i
31972	32288	32422	T: gls254
32423	33053	33120	T: gls254prot
32625	33480	35843	T: hecfp128i
32895	34380	36518	T: prjfp128bk
38115	39128	40702	T: hecfp128bk
39218	39577	40163	T: k277taa
39060	40297	41377	T: hecfp128fkt
44573	45428	46328	T: kummer
47002	47632	48330	T: k298
61065	62550	63158	T: k277mon
58095	67612	72022	T: gls1271
92835	95895	106673	T: kumfp128g
109283	117697	130838	T: curve25519
126540	134618	154553	T: ed448goldilocks
192578	203738	224820	T: nistp256
594360	606397	680602	T: ed521gs
708638	719528	745133	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
30420	30757	30803	T: gls254
31905	32625	32647	T: gls254prot
38610	38745	39150	T: k277taa
43897	43965	44325	T: kummer
46102	46373	46553	T: k298
61515	63000	63090	T: k277mon
83700	84578	90068	T: kumfp128g
85973	86963	94500	T: jacfp128bk
98145	102015	116797	T: hecfp128bk
101273	102038	102420	T: curve25519
98325	108068	112207	T: prjfp128bk
105705	110677	118170	T: hecfp128fkt
113985	115042	115065	T: curve2251
112500	117653	124200	T: gls1271
118080	125663	131355	T: jacfp127i
135113	143505	162900	T: hecfp127i
176332	182205	193028	T: prjfp127i
178830	184050	193612	T: hecfp128i
362632	365220	372420	T: ed448goldilocks
438840	441315	444060	T: nistp256
581535	595035	604237	T: ed521gs
701910	711248	719055	T: nist521gs

amd64; Zen (810f81); 2019 AMD Ryzen Embedded R1606G; 2 x 2600MHz; unstable; `ghf51`, `supercop-20200702`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
55198	57382	64194	curve2251
62218	64870	69030	ecfp256s
60632?	66118?	81640?	ecfp256h
62764?	67340?	85644?	ecfp256e
64870	72670	74828	gls254prot
68068	73242	75790	gls254
84448	87074	99268	k277taa
96330	97578	112996	k298
73034?	98332?	103012?	ecfp256q
135668	136552	168402	k277mon
118820?	156208?	161486?	gls1271
165672	166062	166478	kummer
221286	223366	275522	curve25519
262730	263666	264654	surf127eps
270348	274326	283764	sclaus1024
283322	285506	289744	ecfp256i
346164?	417794?	467220?	hector
368732?	444548?	519636?	ed448goldilocks
560534	664456	676182	nistp256
772928?	909246?	1042834?	surf2113
1589042	1593852	1617720	ed521gs
1587716?	1595906?	2398032?	claus
1698346	1751880	1883336	nist521gs
1538082?	2000830?	2065440?	sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
65260	69368	73658	gls254
62764	72514	74438	gls254prot
86190	86450	98748	k277taa
95992	96356	112970	k298
135564	135668	168168	k277mon
165464	165646	165880	kummer
197990	198276	227760	curve2251
237770	238056	297128	curve25519
255996	256568	257452	surf127eps
264394?	266474?	385788?	ecfp256e
269464?	273130?	390780?	sclaus1024
280566	281164	283790	ecfp256i
307424?	308282?	442936?	ecfp256h
322348	323102	333762	ecfp256s
261222?	379886?	386984?	ecfp256q
292604?	390104?	396344?	gls1271
767520?	891488?	1048424?	surf2113
1147588?	1338168?	1571414?	hector
917800?	1339182?	1358734?	ed448goldilocks
1353612	1527812	1551212	nistp256
1537380	1589770	1591850	ed521gs
1587872?	1590524?	2397434?	claus
1697410	1705288	1974752	nist521gs
1382004?	2020798?	2054494?	sclaus2048

amd64; CometLake (806ec); 2019 Intel Core i3-10110U; 2 x 2100MHz; `comet`, `supercop-20220213`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
20961	21454	22270	T: kumjacfp127g
21572	22576	23315	T: jacfp127i
25261	26053	26949	T: prjfp127i
25996	26854	27832	T: hecfp127i
30267	31328	32259	T: jacfp128bk
35808	36454	37276	T: prjfp128bk
37201	37471	37858	T: gls254
36964	37929	39196	T: hecfp128i
37548	38244	39122	T: hecfp128fkt
37744	38410	39173	T: hecfp128bk
38269	38836	39693	T: curve2251
39061	39098	39147	T: gls254prot
45139	45656	46463	T: ecfp256e
45886	46293	46331	T: k277taa
46023	46898	48889	T: ecfp256h
49317	49825	50475	T: ecfp256s
51387	51941	52956	T: ecfp256q
53340	53403	53487	T: kummer
54086	54195	54408	T: k298
69921	70762	71611	T: gls1271
70365	71721	72298	T: k277mon
79226	79395	80104	T: kumfp127g
112736	112804	112916	T: kumfp128g
126478	126705	126951	T: curve25519
153511	153752	153969	T: ed448goldilocks
177698	179528	181105	T: sclaus1024
184190	187033	187854	T: surf127eps
192971	196204	203161	T: ecfp256i
235513	236319	237024	T: nistp256
257327	264420	276371	T: hector
504448	506315	507508	T: surf2113
816517	817163	818623	T: ed521gs
912497	922458	965766	T: sclaus2048
978281	979937	982372	T: nist521gs
981241	983435	988884	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
36139	36198	36292	T: gls254
38866	38905	38970	T: gls254prot
45686	46070	46105	T: k277taa
53214	53286	53350	T: kummer
53331	53422	53526	T: k298
71615	71720	72960	T: k277mon
81649	82198	82607	T: kumfp127g
82941	83819	83961	T: kumjacfp127g
89129	89199	89325	T: jacfp128bk
108668	109210	110174	T: prjfp128bk
114237	114522	114879	T: hecfp128bk
117916	118031	118231	T: hecfp128fkt
118063	118162	118348	T: kumfp128g
124483	125615	125928	T: jacfp127i
136171	136590	137443	T: curve25519
143766	144005	144139	T: curve2251
166194	166810	167329	T: prjfp127i
167692	168961	169421	T: hecfp127i
172057	174412	176158	T: gls1271
175382	179286	179682	T: sclaus1024
179396	179749	180622	T: ecfp256e
179904	182356	183419	T: surf127eps
188871	189145	189754	T: ecfp256i
189274	189591	190288	T: ecfp256q
222509	222824	223451	T: ecfp256h
241566	242083	242672	T: ecfp256s
254453	255188	255860	T: hecfp128i
458517	458832	459161	T: ed448goldilocks
504878	505329	505736	T: surf2113
584151	585057	587562	T: nistp256
817024	822628	837240	T: ed521gs
873090	878162	884112	T: hector
930086	953186	968792	T: sclaus2048
975599	978328	981745	T: claus
978963	980355	982574	T: nist521gs

amd64; CascadeLake (50657); 2019 Intel Xeon Gold 6230; 40 x 2100MHz; unstable; `cel02`, `supercop-20201130`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
32706	33234	34614	T: kumjacfp127g
34626	36210	37558	T: jacfp127i
41590	43194	45956	T: prjfp127i
44246	46096	48166	T: hecfp127i
50694	52028	54010	T: jacfp128bk
52368	53050	58760	T: curve2251
56344	57624	58716	T: prjfp128bk
56102	57844	59168	T: hecfp128bk
56550	57850	59190	T: hecfp128fkt
57908	59134	60432	T: hecfp128i
61352	62204	65598	T: gls254
63160	63326	67712	T: gls254prot
67254	69026	70854	T: ecfp256e
67258	70098	74296	T: ecfp256s
67748	71136	73004	T: ecfp256h
74484	74580	74672	T: k277taa
73186	75078	81258	T: ecfp256q
76650	80986	83830	T: k298
81292	86034	87222	T: kummer
90616	95962	96848	T: k277mon
131428	132014	138058	T: kumfp127g
180704	187438	190238	T: curve25519
207584	207848	222432	T: kumfp128g
291054	293440	293864	T: ed448goldilocks
289238	299022	307752	T: ecfp256i
311962	315190	320638	T: surf127eps
336350	341930	345948	T: sclaus1024
539896	549466	557090	T: nistp256
948680	1004152	1009544	T: surf2113
1613022	1636248	1654726	T: sclaus2048
1763428	1802116	2137402	T: nist521gs
1805136	1875428	2031300	T: claus
2692014	2887980	2900652	T: ed521gs

Cycles to compute a shared secret
25%	50%	75%	system
59138	59976	63690	T: gls254
63046	63206	67656	T: gls254prot
74342	74444	74512	T: k277taa
76082	81032	83466	T: k298
81148	85906	87150	T: kummer
90686	95684	96706	T: k277mon
133636	134070	140032	T: kumfp127g
137676	138248	140764	T: kumjacfp127g
138810	148094	156238	T: jacfp128bk
167780	172656	179216	T: hecfp128bk
170598	178212	180194	T: prjfp128bk
180762	189168	191758	T: hecfp128fkt
184830	192414	192694	T: curve2251
190144	200382	200944	T: curve25519
199346	204780	209558	T: jacfp127i
213424	213694	227676	T: kumfp128g
252548	257326	262096	T: hecfp127i
266828	286710	287234	T: prjfp127i
277024	292936	298704	T: ecfp256q
294152	295808	303758	T: ecfp256i
277480	298268	301952	T: ecfp256e
304446	306020	311120	T: surf127eps
326546	333844	354906	T: ecfp256h
323260	346148	349038	T: sclaus1024
339934	352680	376502	T: ecfp256s
402470	416534	417002	T: hecfp128i
794500	795626	796456	T: ed448goldilocks
993414	995938	1007624	T: surf2113
1099488	1151012	1186786	T: nistp256
1507836	1622894	1693056	T: sclaus2048
1794748	1821518	2022596	T: claus
1788816	2013584	2136836	T: nist521gs
2647034	2869572	2897724	T: ed521gs

amd64; CascadeLake (50657); 2019 Intel Core i9-10980XE; 18 x 3000MHz; `avx512imath`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
22942	23920	25532	T: jacfp127i
24521	25508	26466	T: kumjacfp127g
30537	32391	34632	T: prjfp127i
31488	33166	35239	T: hecfp127i
33309	34366	35420	T: jacfp128bk
35112	35712	37647	T: prjfp128bk
38459	38763	41612	T: curve2251
38696	39119	39493	T: gls254
40378	40410	40446	T: gls254prot
41277	43173	46538	T: hecfp128bk
41880	43460	46879	T: hecfp128fkt
43162	44302	47228	T: ecfp256e
43205	44922	46417	T: hecfp128i
45616	46857	50701	T: ecfp256h
47040	48039	51942	T: ecfp256s
48533	48578	48625	T: kummer
50011	50042	50100	T: k277taa
50836	51368	52401	T: ecfp256q
69976	71077	72303	T: gls1271
74181	74401	74479	T: k277mon
79992	80102	80227	T: kumfp127g
113033	113138	113281	T: kumfp128g
126053	127104	127295	T: curve25519
180867	181318	181751	T: ed448goldilocks
192604	193530	195076	T: ecfp256i
230062	232318	234278	T: sclaus1024
274593	274830	286603	T: nistp256
815460	816320	817222	T: ed521gs
945603	946034	946657	T: nist521gs
976164	976586	977059	T: claus
1149504	1158740	1167421	T: sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
37542	37566	37600	T: gls254
40277	40303	40335	T: gls254prot
48451	48495	48544	T: kummer
49946	49981	50031	T: k277taa
74104	74343	74414	T: k277mon
82293	82388	82513	T: kumfp127g
83670	83756	83833	T: kumjacfp127g
89241	89321	89393	T: jacfp128bk
109675	109801	109973	T: prjfp128bk
117523	117687	117840	T: hecfp128bk
118274	118346	118798	T: kumfp128g
120759	120853	120965	T: hecfp128fkt
125607	125699	125818	T: jacfp127i
136236	136787	137606	T: curve25519
142402	144055	144380	T: curve2251
166911	167038	167186	T: prjfp127i
170436	170638	174190	T: hecfp127i
171219	173467	179102	T: gls1271
177659	177835	178025	T: ecfp256e
187333	187569	187788	T: ecfp256q
188174	188325	188525	T: ecfp256i
221385	221564	221721	T: ecfp256h
241705	241876	242093	T: ecfp256s
244691	246341	249729	T: sclaus1024
258262	258759	259196	T: hecfp128i
509021	509336	509626	T: ed448goldilocks
686877	687235	687513	T: nistp256
815272	815800	816798	T: ed521gs
945263	945700	946329	T: nist521gs
970505	970866	971374	T: claus
1175498	1186144	1192945	T: sclaus2048

aarch64; Skylark (503f0002); 2018 Ampere eMAG 8180; 32 x 3300MHz; `gcc185`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
278025	278685	280005	T: curve25519
355245	355245	355410	T: kummer
379170	380985	384780	T: surf127eps
461010	465630	471405	T: sclaus1024
495495	495660	496320	T: nistp256
1711380	1712700	1717980	T: ed521gs
2089065	2089230	2091045	T: nist521gs
2227335	2253405	2293830	T: sclaus2048
2725965	2732730	2738670	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
278025	278850	280005	T: curve25519
355245	355245	355245	T: kummer
377025	378675	381480	T: surf127eps
459855	466620	476850	T: sclaus1024
1108305	1109130	1109625	T: nistp256
1711545	1712370	1713360	T: ed521gs
2088735	2089560	2090385	T: nist521gs
2260335	2265780	2294160	T: sclaus2048
2723490	2727615	2729925	T: claus

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; `pi3aplus`, `supercop-20220506`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
422142	427201	428401	T: kummer
469637	475131	475311	T: curve25519
473251	478043	478658	T: nistp256
609447	612861	615570	T: surf127eps
997045	1005628	1019043	T: sclaus1024
3100828	3145520	3160808	T: ed521gs
3601356	3649157	3658747	T: nist521gs
4909592	4948255	4997230	T: sclaus2048
5553122	5565532	5582570	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
421426	426641	427379	T: kummer
475903	481449	481615	T: curve25519
606059	607071	611862	T: surf127eps
1010084	1015229	1020164	T: sclaus1024
1600273	1605000	1613138	T: nistp256
3099190	3145238	3159950	T: ed521gs
3582681	3594926	3602171	T: nist521gs
4900628	4946618	5013522	T: sclaus2048
5481574	5498392	5516280	T: claus

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; `pi3bplus`, `supercop-20210604`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
421690	422033	422861	T: kummer
472614	474796	505959	T: nistp256
504641	509274	527868	T: curve25519
635917	638790	645312	T: surf127eps
1034237	1044237	1052519	T: sclaus1024
3101818	3126330	3339774	T: ed521gs
3621448	3836180	3908128	T: nist521gs
5102961	5146953	5173387	T: sclaus2048
5360477	5449700	5471666	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
421577	421869	422302	T: kummer
503856	504454	528443	T: curve25519
631638	635860	640814	T: surf127eps
1038487	1062196	1069787	T: sclaus1024
1596444	1604779	1697174	T: nistp256
3099062	3121488	3341374	T: ed521gs
3615688	3755807	3883894	T: nist521gs
5098992	5125845	5154634	T: sclaus2048
5334733	5412856	5429611	T: claus

amd64; Zen (810f10); 2018 AMD Ryzen 5 2400G; 4 x 3600MHz; unstable; `gcc67`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
26100	28887	30179	T: jacfp127i
27798	29148	31092	T: prjfp127i
28176	29450	30679	T: kumjacfp127g
31042	33271	34776	T: hecfp127i
35417	38204	39641	T: jacfp128bk
38816	39290	39867	T: prjfp128bk
38636	39626	41575	T: ecfp256e
39229	40837	42683	T: hecfp128bk
40174	40878	41505	T: hecfp128fkt
41275	41674	43237	T: curve2251
41120	43241	44824	T: hecfp128i
41835	43622	46974	T: ecfp256h
44795	45128	45436	T: gls254
43529	45452	48952	T: ecfp256s
45971	46031	46102	T: gls254prot
45924	46771	49560	T: ecfp256q
56790	56836	57064	T: k277taa
66249	66755	67447	T: gls1271
74196	74339	74542	T: k298
90249	90287	91185	T: k277mon
93088	95119	95502	T: kummer
101568	101636	101729	T: kumfp127g
133240	133311	133411	T: kumfp128g
143961	144006	144021	T: curve25519
183938	184827	186105	T: ecfp256i
189608	190564	193164	T: surf127eps
201021	203066	204964	T: sclaus1024
210045	210207	210545	T: ed448goldilocks
369991	370321	370625	T: nistp256
513214	515401	524601	T: surf2113
971495	972254	973966	T: ed521gs
996317	1004779	1015192	T: sclaus2048
1191690	1194896	1198080	T: claus
1197072	1198680	1200438	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
43843	43888	43905	T: gls254
45912	45973	46030	T: gls254prot
56606	56708	56743	T: k277taa
74122	74233	74354	T: k298
87582	90181	90219	T: k277mon
93049	95106	95464	T: kummer
104235	104338	104366	T: kumfp127g
104572	104619	104740	T: jacfp128bk
106352	106428	106486	T: kumjacfp127g
126596	126715	126881	T: prjfp128bk
129908	130080	130174	T: hecfp128bk
134371	134529	134739	T: hecfp128fkt
139257	139309	140127	T: kumfp128g
156686	156933	158458	T: curve25519
160599	161303	169512	T: gls1271
162311	162476	163170	T: jacfp127i
162533	163305	163972	T: curve2251
174075	174244	174585	T: ecfp256e
182367	182586	183086	T: ecfp256i
183685	183800	183967	T: ecfp256q
183883	184106	188444	T: surf127eps
203613	203710	204185	T: prjfp127i
195600	204265	206569	T: sclaus1024
207468	207758	208062	T: hecfp127i
215646	215720	215883	T: ecfp256h
235825	236173	236390	T: ecfp256s
285708	285886	286139	T: hecfp128i
507678	514240	515933	T: surf2113
641513	643332	645617	T: ed448goldilocks
676527	677324	677905	T: nistp256
969593	970968	972690	T: ed521gs
990477	996065	998992	T: sclaus2048
1196328	1197132	1199707	T: nist521gs
1193789	1197872	1199786	T: claus

amd64; CoffeeLake (906ea); 2018 Intel Xeon E-2124; 4 x 3300MHz; `r24000`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
21661	22711	23683	T: jacfp127i
22493	23179	24734	T: kumjacfp127g
25225	26008	27501	T: prjfp127i
25767	26899	28107	T: hecfp127i
30130	31341	32445	T: jacfp128bk
35691	36702	37765	T: prjfp128bk
36779	36999	37458	T: gls254
37485	38423	39577	T: hecfp128bk
37625	38583	39492	T: hecfp128fkt
38481	38730	39277	T: curve2251
37840	38761	39696	T: hecfp128i
38842	38886	38941	T: gls254prot
42613	43294	44479	T: ecfp256e
45068	45628	47622	T: ecfp256h
45871	45924	46013	T: k277taa
46431	47099	48527	T: ecfp256s
48210	49058	50823	T: ecfp256q
52114	52336	52435	T: k298
52999	53469	54166	T: kummer
68871	69742	70607	T: gls1271
71305	71341	71381	T: k277mon
79029	79175	79301	T: kumfp127g
110414	110463	110525	T: kumfp128g
125164	125303	125539	T: curve25519
153365	153650	153924	T: ed448goldilocks
175276	177093	178576	T: sclaus1024
182804	183483	183936	T: surf127eps
190141	190965	192103	T: ecfp256i
245414	245637	245857	T: nistp256
505054	507069	508382	T: surf2113
807735	808041	808412	T: ed521gs
886258	892693	899201	T: sclaus2048
935142	935388	935732	T: nist521gs
968823	969306	969730	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
35762	35792	35829	T: gls254
38568	38614	38652	T: gls254prot
45636	45671	45779	T: k277taa
51833	51908	51977	T: k298
52916	53166	53422	T: kummer
71218	71251	71288	T: k277mon
81334	81448	81568	T: kumfp127g
82825	82913	83004	T: kumjacfp127g
87511	87582	87656	T: jacfp128bk
108166	108289	108432	T: prjfp128bk
112033	112208	112347	T: hecfp128bk
115562	115609	115658	T: kumfp128g
116042	116239	116428	T: hecfp128fkt
124253	124340	124500	T: jacfp127i
135014	135390	135608	T: curve25519
144596	144704	144868	T: curve2251
165179	165324	165553	T: prjfp127i
167127	167242	167386	T: hecfp127i
175293	175416	175559	T: ecfp256e
173439	177271	177717	T: gls1271
174619	178909	182563	T: sclaus1024
179295	179646	179986	T: surf127eps
185319	185469	185640	T: ecfp256q
185598	185734	185867	T: ecfp256i
217913	218109	218299	T: ecfp256h
239745	239931	240098	T: ecfp256s
247956	248140	248319	T: hecfp128i
454987	455224	455421	T: ed448goldilocks
488007	498433	506233	T: surf2113
599149	599319	599533	T: nistp256
807181	807458	807712	T: ed521gs
895100	901153	901871	T: sclaus2048
934831	935010	935215	T: nist521gs
963006	963550	964877	T: claus

riscv64; U54 (sifive,u54-mc); 2017 SiFive Freedom U540; 4 x 1000MHz; `riscvunleashed000`, `supercop-20210326`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
1176291	1176624	1191114	T: kummer
1332777	1333831	1350970	T: curve25519
1792948	1797783	1817687	T: nistp256
6035312	6051076	6062589	T: ed521gs
7185443	7186713	7198473	T: nist521gs
13742830	13754983	13762774	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
1176017	1176157	1189878	T: kummer
1331496	1332360	1349154	T: curve25519
3494268	3494893	3495869	T: nistp256
6033781	6048489	6050121	T: ed521gs
7183650	7184938	7186026	T: nist521gs
13675066	13687602	13699928	T: claus

amd64; Zen (800f12); 2017 AMD EPYC 7501; 32 x 2000MHz; unstable; `colossus5`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
27500	28060	28680	T: kumjacfp127g
27980?	30540?	36080?	T: jacfp127i
29920	30940	31840	T: prjfp127i
36520	38720	41680	T: hecfp127i
41440	42600	45240	T: ecfp256e
42420	44540	47160	T: hecfp128fkt
43660	44880	46180	T: hecfp128i
42980	45060	49220	T: prjfp128bk
43980	45720	50540	T: hecfp128bk
44400	45940	47600	T: jacfp128bk
45140	46300	50160	T: curve2251
46260	49380	57780	T: ecfp256s
45940?	50680?	59540?	T: ecfp256h
48240	51640	59280	T: ecfp256q
51640	51940	52500	T: gls254
53080	53200	54420	T: gls254prot
64800	64820	65360	T: k277taa
64900	65600	66500	T: gls1271
76360	76540	77280	T: k298
93480	93840	93940	T: k277mon
101720	101960	102080	T: kummer
101980	102060	102140	T: kumfp127g
133380	133440	133520	T: kumfp128g
144340	144440	150280	T: curve25519
185480	186320	187800	T: ecfp256i
236760	237420	239040	T: ed448goldilocks
266280	268740	271400	T: sclaus1024
337600	338140	346520	T: nistp256
1025440	1028200	1040120	T: ed521gs
1193560	1196640	1206080	T: nist521gs
1339820	1343540	1349060	T: claus
1346920	1359380	1369280	T: sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
49660	49680	49860	T: gls254
53080	53200	54240	T: gls254prot
64720	64800	65180	T: k277taa
76260	76320	76440	T: k298
93140	93420	93620	T: k277mon
101680	101820	102020	T: kummer
104480	104500	104540	T: kumfp127g
104920	105000	105220	T: jacfp128bk
106340	106380	106480	T: kumjacfp127g
126760	126820	126920	T: prjfp128bk
130100	130340	130840	T: hecfp128bk
135280	135360	135460	T: hecfp128fkt
139280	139300	139360	T: kumfp128g
156840	157400	158900	T: curve25519
162580	162720	162880	T: jacfp127i
162320	163500	164540	T: curve2251
165780	167580	170840	T: gls1271
173760	173920	174100	T: ecfp256e
183020	183120	183360	T: ecfp256i
183760	184040	184560	T: ecfp256q
203900	204020	204440	T: prjfp127i
207240	207320	207400	T: hecfp127i
216180	216320	216420	T: ecfp256h
235780	235960	236260	T: ecfp256s
279440	280420	281360	T: sclaus1024
285800	286040	286440	T: hecfp128i
687360	688840	688980	T: ed448goldilocks
865500	865780	866200	T: nistp256
1024780	1025700	1041580	T: ed521gs
1192620	1195240	1213300	T: nist521gs
1334160	1335540	1340600	T: claus
1371360	1377440	1387380	T: sclaus2048

amd64; Zen (800f12); 2017 AMD EPYC 7451; 48 x 2300MHz; unstable; `firefly`, `supercop-20201130`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
34707	36593	39698	T: jacfp127i
35052	36754	38939	T: prjfp127i
36731	38939	42320	T: hecfp127i
38410	41262	43125	T: kumjacfp127g
42136	44666	47771	T: jacfp128bk
45471	46391	51980	T: curve2251
48047	51474	54487	T: prjfp128bk
49174	52532	56741	T: hecfp128bk
48990	52992	56327	T: hecfp128fkt
55177	56971	59708	T: hecfp128i
56534	57224	57960	T: gls254prot
56925	57684	58420	T: ecfp256h
59156	59823	62054	T: gls254
59340	61134	64078	T: ecfp256q
68885	68954	69046	T: k277taa
69483	69943	71461	T: ecfp256e
75141	75532	76015	T: ecfp256s
89102	89654	90068	T: k298
107617	107663	113620	T: kummer
114862	128616	134435	T: kumfp127g
128087	129720	136206	T: k277mon
150535	155066	158447	T: curve25519
163783	164105	183724	T: kumfp128g
236693	239384	259969	T: ecfp256i
255001	258957	271216	T: sclaus1024
263718	266294	291134	T: surf127eps
270158	279473	301162	T: ed448goldilocks
431296	432722	470166	T: nistp256
664999	813625	820594	T: surf2113
1132290	1145469	1158694	T: sclaus2048
1504269	1532651	1606343	T: claus
1487203	1585229	1636013	T: ed521gs
1907206	1934990	1982899	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
56396	57132	57500	T: gls254prot
59087	59731	62491	T: gls254
68793	68862	68931	T: k277taa
87929	89125	89861	T: k298
108307	108537	113551	T: kummer
114977	123579	124200	T: jacfp128bk
127926	129559	135884	T: k277mon
116610	130364	136206	T: kumfp127g
120106?	138943?	152927?	T: kumjacfp127g
146671	147706	164611	T: hecfp128fkt
138276	147729	149109	T: prjfp128bk
141404	152720	153433	T: hecfp128bk
160563	163875	164611	T: curve2251
168452	168728	188485	T: kumfp128g
166359	169487	171304	T: curve25519
192211	203021	203550	T: jacfp127i
216867	221996	236463	T: ecfp256q
230368	230920	237245	T: ecfp256e
233404	234071	257485	T: ecfp256i
236279	236647	236992	T: prjfp127i
238832	240833	254058	T: hecfp127i
257278	262338	282440	T: surf127eps
251114	262729	277127	T: sclaus1024
267099	272113	274252	T: ecfp256h
296631	298333	298954	T: ecfp256s
341251	355051	355373	T: hecfp128i
657478?	820203?	822802?	T: surf2113
857118	875817	972739	T: ed448goldilocks
1136315	1146090	1162903	T: sclaus2048
1424689	1523359	1605699	T: claus
1432946	1556502	1597189	T: nistp256
1486996	1578490	1648525	T: ed521gs
1907620	1938049	1997665	T: nist521gs

amd64; Zen (800f11); 2017 AMD Ryzen 7 1700; 8 x 3000MHz; `rumba7`, `supercop-20220506`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
28522	29448	30465	T: jacfp127i
29235	30018	30923	T: kumjacfp127g
32500	33641	35048	T: prjfp127i
32873	33826	35155	T: hecfp127i
37869	38838	39785	T: jacfp128bk
39958	40907	43432	T: curve2251
40097	41164	43930	T: ecfp256e
40965	42352	44282	T: hecfp128i
43562	43674	43903	T: gls254
42913	43973	44931	T: prjfp128bk
43272	44391	45405	T: hecfp128fkt
43852	44572	45593	T: hecfp128bk
44791	44813	44879	T: gls254prot
43700	45950	51371	T: ecfp256h
44664	46737	51654	T: ecfp256s
47112	49230	53959	T: ecfp256q
55680	55904	55975	T: k277taa
66971	67174	67423	T: k298
67243	67966	68535	T: gls1271
87075	87223	87260	T: k277mon
95119	95211	95691	T: kummer
101898	101961	102028	T: kumfp127g
133273	133326	133386	T: kumfp128g
144498	144528	149366	T: curve25519
184708	185586	186939	T: ecfp256i
186957	187598	187931	T: surf127eps
199453	199615	199901	T: ed448goldilocks
201458	203043	204976	T: sclaus1024
272760	272901	273454	T: nistp256
530694	533435	534721	T: surf2113
896534	897672	899498	T: ed521gs
988744	997326	1006009	T: sclaus2048
1094801	1096097	1140749	T: nist521gs
1191652	1195375	1198766	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
42435	42447	42464	T: gls254
44745	44773	44820	T: gls254prot
55740	55829	55899	T: k277taa
67006	67098	67182	T: k298
87159	87199	87221	T: k277mon
95066	95110	95659	T: kummer
103827	103928	104014	T: jacfp128bk
104383	104447	104566	T: kumfp127g
106275	106395	106493	T: kumjacfp127g
126640	126716	126887	T: prjfp128bk
129849	129963	130091	T: hecfp128bk
134558	134718	134839	T: hecfp128fkt
139129	139171	139210	T: kumfp128g
157200	158972	172551	T: curve25519
159523	160098	160800	T: curve2251
162475	162546	162826	T: jacfp127i
163447	163711	167613	T: gls1271
173433	173525	173602	T: ecfp256e
181951	182171	182296	T: ecfp256i
183317	183597	183685	T: ecfp256q
183372	183765	184261	T: surf127eps
197493	203312	204718	T: sclaus1024
203515	203813	204255	T: prjfp127i
207447	207622	209398	T: hecfp127i
216350	216397	216500	T: ecfp256h
235470	235809	236609	T: ecfp256s
285827	286103	287064	T: hecfp128i
527494	532035	532498	T: surf2113
586294	586995	589535	T: ed448goldilocks
663841	664045	664435	T: nistp256
895604	897628	899323	T: ed521gs
985451	989803	1004919	T: sclaus2048
1095547	1096742	1143434	T: nist521gs
1185630	1194512	1200167	T: claus

amd64; Zen (800f11); 2017 AMD Ryzen 5 1600; 6 x 3200MHz; `rumba5`, `supercop-20220506`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
29820	30575	31661	T: jacfp127i
29890	30910	32174	T: kumjacfp127g
32881	34168	35893	T: prjfp127i
33820	34964	36552	T: hecfp127i
38198	39529	40743	T: jacfp128bk
39855	41197	44646	T: curve2251
40587	41807	44913	T: ecfp256e
43536	44423	45548	T: prjfp128bk
44791	44813	44879	T: gls254prot
44716	44879	45045	T: gls254
43949	45104	46195	T: hecfp128bk
44240	45297	46076	T: hecfp128fkt
44406	45384	46225	T: hecfp128i
44464	46640	52357	T: ecfp256h
45227	47437	52715	T: ecfp256s
47746	50177	55743	T: ecfp256q
55670	55824	55956	T: k277taa
64847	65443	65725	T: k298
66231	66938	67681	T: gls1271
87097	87190	87290	T: k277mon
95114	95656	95690	T: kummer
101854	101937	102021	T: kumfp127g
133254	133321	133375	T: kumfp128g
144562	144581	144616	T: curve25519
184723	185692	186967	T: ecfp256i
187228	187899	188320	T: surf127eps
199328	199526	199805	T: ed448goldilocks
201041	202596	204636	T: sclaus1024
273658	273821	273974	T: nistp256
531504	533908	536114	T: surf2113
895508	896733	899010	T: ed521gs
990003	998299	1006779	T: sclaus2048
1095713	1096749	1097764	T: nist521gs
1190513	1194051	1197808	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
42165	42183	42201	T: gls254
44736	44764	44814	T: gls254prot
55718	55815	55906	T: k277taa
64674	64723	64777	T: k298
87071	87140	87216	T: k277mon
95017	95637	95640	T: kummer
104400	104463	104516	T: kumfp127g
104390	104489	104617	T: jacfp128bk
106331	106396	106466	T: kumjacfp127g
126456	126512	126600	T: prjfp128bk
130022	130152	130321	T: hecfp128bk
134518	134612	134757	T: hecfp128fkt
139092	139122	139313	T: kumfp128g
157260	157515	159050	T: curve25519
159897	161339	161986	T: curve2251
162475	162670	162797	T: jacfp127i
159990	164133	165312	T: gls1271
173521	173761	174755	T: ecfp256e
181997	182175	182346	T: ecfp256i
183262	183355	183501	T: ecfp256q
183564	184818	185061	T: surf127eps
197840	201320	202203	T: sclaus1024
203935	204135	205185	T: prjfp127i
207366	207491	207692	T: hecfp127i
216169	216277	216409	T: ecfp256h
235661	235744	235977	T: ecfp256s
285464	285708	286026	T: hecfp128i
532518	533309	535304	T: surf2113
588527	590392	590617	T: ed448goldilocks
664008	664208	665032	T: nistp256
895079	896875	897726	T: ed521gs
981121	1000432	1015455	T: sclaus2048
1093802	1094939	1095910	T: nist521gs
1191120	1192145	1200226	T: claus

amd64; Zen (800f11); 2017 AMD Ryzen 3 1200; 4 x 3100MHz; `rumba3`, `supercop-20200906`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
29171	29853	31062	T: jacfp127i
29636	30628	31527	T: kumjacfp127g
32736	33945	35247	T: prjfp127i
33325	34472	35898	T: hecfp127i
38223	39184	40610	T: jacfp128bk
40114	40610	42625	T: curve2251
40455	41726	44609	T: ecfp256e
43586	43772	44051	T: gls254
43524	44485	45663	T: hecfp128fkt
43555	44516	45911	T: prjfp128bk
44795	44826	44888	T: gls254prot
43958	45012	46035	T: hecfp128i
43989	45012	46190	T: hecfp128bk
43741	46345	50964	T: ecfp256h
44857	46903	51801	T: ecfp256s
47771	49383	54560	T: ecfp256q
55149	55211	55242	T: k277taa
64821	65472	65658	T: k298
87079	87234	92287	T: k277mon
95542	95604	95914	T: kummer
101928	102052	102548	T: kumfp127g
133362	133393	133486	T: kumfp128g
144491	144584	144615	T: curve25519
185132	186124	187457	T: ecfp256i
187271	188139	189906	T: surf127eps
199423	199671	200291	T: ed448goldilocks
202771	205282	209684	T: sclaus1024
273761	273916	274908	T: nistp256
530999	533076	533820	T: surf2113
897047	898318	899744	T: ed521gs
995100	1003408	1010693	T: sclaus2048
1097989	1099260	1100500	T: nist521gs
1192849	1195949	1199824	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
42408	42439	42935	T: gls254
44764	44795	45446	T: gls254prot
55056	55180	55211	T: k277taa
64821	64914	65441	T: k298
87017	87203	92132	T: k277mon
95511	95635	95914	T: kummer
103912	104098	104656	T: jacfp128bk
104377	104501	106144	T: kumfp127g
106361	106423	106485	T: kumjacfp127g
126387	126728	126945	T: prjfp128bk
129859	130293	130386	T: hecfp128bk
134478	134602	134695	T: hecfp128fkt
139190	139221	139283	T: kumfp128g
160177	161045	161851	T: curve2251
162440	162502	162688	T: jacfp127i
158689	163432	172608	T: curve25519
173321	173445	173569	T: ecfp256e
182249	182435	182528	T: ecfp256i
182683	183055	184295	T: surf127eps
183458	183582	184574	T: ecfp256q
204104	204228	204445	T: prjfp127i
207018	207266	208568	T: hecfp127i
206987	207297	210676	T: sclaus1024
215977	216039	216132	T: ecfp256h
235786	235879	236003	T: ecfp256s
285758	287401	287990	T: hecfp128i
530472	530813	532704	T: surf2113
587977	589000	589868	T: ed448goldilocks
664423	664733	676606	T: nistp256
895125	896210	896737	T: ed521gs
989706	1000153	1013979	T: sclaus2048
1098330	1099942	1101957	T: nist521gs
1189439	1192167	1199235	T: claus

amd64; KabyLake (906e9); 2017 Intel Xeon E3-1220 v6; 4 x 3000MHz; `kizomba`, `supercop-20220506`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
20851	21905	23770	T: kumjacfp127g
22036	23085	24459	T: jacfp127i
26111	27143	28889	T: prjfp127i
25792	27405	30594	T: hecfp127i
30881	32228	34799	T: jacfp128bk
35002	36536	38685	T: prjfp128bk
36873	37170	42381	T: gls254
38099	38258	39401	T: curve2251
37567	38663	41037	T: hecfp128bk
37716	38750	39881	T: hecfp128i
38797	38859	38929	T: gls254prot
37448	38905	42046	T: hecfp128fkt
42740	43700	48925	T: ecfp256e
45748	45901	46000	T: k277taa
45272	46051	50689	T: ecfp256h
47411	48044	50655	T: ecfp256s
48104	49067	54722	T: ecfp256q
50220	50478	50621	T: kummer
52500	52621	52822	T: k298
69947	70170	70414	T: k277mon
69669	70559	74691	T: gls1271
79186	79307	79410	T: kumfp127g
110575	110654	115361	T: kumfp128g
125299	127466	130839	T: curve25519
153137	153645	159359	T: ed448goldilocks
175730	177926	182206	T: sclaus1024
180933	181688	186841	T: surf127eps
189793	191131	196818	T: ecfp256i
234534	235076	240404	T: nistp256
492555	495274	515714	T: surf2113
810139	815290	854933	T: ed521gs
903210	953304	986315	T: sclaus2048
944671	960199	997258	T: nist521gs
980736	994998	1035344	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
35685	35734	35786	T: gls254
38482	38528	38587	T: gls254prot
45477	45552	45762	T: k277taa
50047	50214	50711	T: kummer
52204	52294	52379	T: k298
69907	70103	70298	T: k277mon
81385	81494	86327	T: kumfp127g
82822	82925	87703	T: kumjacfp127g
88004	88081	88213	T: jacfp128bk
108696	108881	109298	T: prjfp128bk
112387	112521	117323	T: hecfp128bk
115789	115855	120804	T: kumfp128g
119224	119557	124262	T: hecfp128fkt
124360	124494	129690	T: jacfp127i
135216	137258	140010	T: curve25519
144609	144792	150490	T: curve2251
165054	165224	165556	T: prjfp127i
167161	167326	168416	T: hecfp127i
171686	172744	176702	T: gls1271
175597	175847	181095	T: ecfp256e
176345	177919	183298	T: surf127eps
174165	178496	183189	T: sclaus1024
184776	185024	190282	T: ecfp256i
185274	185635	192729	T: ecfp256q
217976	218307	223321	T: ecfp256h
237461	237744	243424	T: ecfp256s
251448	251812	257952	T: hecfp128i
456494	457581	476097	T: ed448goldilocks
491102	493428	513579	T: surf2113
577334	583032	617388	T: nistp256
810129	820489	858772	T: ed521gs
943736	953557	992889	T: nist521gs
913989	955709	983087	T: sclaus2048
965851	978851	1017369	T: claus

amd64; KabyLake (806e9); 2017 Intel Core i7-7567U; 2 x 3500MHz; unstable; `intelnuci7`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
22854	24024	25244	T: jacfp127i
23076	24178	25666	T: kumjacfp127g
25138	26386	27910	T: hecfp127i
26244	27416	29766	T: prjfp127i
31346	32408	33938	T: jacfp128bk
36088	37424	39956	T: hecfp128i
36862	38122	40248	T: hecfp128fkt
37220	38230	39526	T: prjfp128bk
38020	38250	38618	T: gls254
39342	39458	40200	T: curve2251
38304	39606	41796	T: hecfp128bk
40044	40110	40194	T: gls254prot
43854	44594	45714	T: ecfp256e
47236	47288	47348	T: k277taa
46768	47648	49566	T: ecfp256h
47006	47776	49534	T: ecfp256s
49462	50440	52650	T: ecfp256q
51894	52200	52956	T: kummer
54288	54370	54510	T: k298
72248	72378	72610	T: k277mon
71994	72788	73588	T: gls1271
81552	81646	81752	T: kumfp127g
114092	114148	114208	T: kumfp128g
129368	129626	129896	T: curve25519
158112	158318	158604	T: ed448goldilocks
180542	182522	184208	T: sclaus1024
186540	187234	187858	T: surf127eps
195688	196738	197926	T: ecfp256i
217550	226366	238000	T: hector
242064	242480	270748	T: nistp256
508152	510326	511366	T: surf2113
836516	836864	837546	T: ed521gs
913382	920252	927792	T: sclaus2048
970706	971326	972396	T: nist521gs
1006838	1008496	1011858	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
36850	36928	36980	T: gls254
39768	39814	39892	T: gls254prot
46934	46980	47032	T: k277taa
51804	52124	52280	T: kummer
54098	54176	54274	T: k298
72352	72518	74482	T: k277mon
83886	83962	84030	T: kumfp127g
85274	85362	85450	T: kumjacfp127g
90890	90990	91088	T: jacfp128bk
111918	112022	112158	T: prjfp128bk
118500	118660	118848	T: hecfp128bk
119418	119482	119546	T: kumfp128g
122602	122806	123004	T: hecfp128fkt
127970	128042	128146	T: jacfp127i
139286	139568	140018	T: curve25519
148680	149586	149718	T: curve2251
170368	170516	170720	T: prjfp127i
173236	173498	175470	T: hecfp127i
174868	179314	179672	T: gls1271
172194	180938	185840	T: sclaus1024
181232	181406	181554	T: ecfp256e
183398	183722	184034	T: surf127eps
190906	191084	191228	T: ecfp256i
191248	191408	191566	T: ecfp256q
225138	225284	225548	T: ecfp256h
245790	246000	246200	T: ecfp256s
256004	256202	256392	T: hecfp128i
471048	471346	471646	T: ed448goldilocks
505542	506108	508468	T: surf2113
595818	596138	596506	T: nistp256
740472	746538	753674	T: hector
836072	836278	836634	T: ed521gs
912476	915646	935020	T: sclaus2048
970230	970696	972034	T: nist521gs
991354	993798	1041200	T: claus

aarch64; A57+crypto (411fd072); 2016 AMD Opteron A1100; 8 x 2000MHz; `warbear0`, `supercop-20200826`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
242272	242272	242288	T: kummer
338112	338800	339216	T: curve25519
367424	367440	367584	T: nistp256
1971904	1972368	1976800	T: ed521gs
2440928	2444240	2445904	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
240848	240848	240848	T: kummer
338032	338160	338736	T: curve25519
1269552	1269584	1270144	T: nistp256
1969392	1970768	1971424	T: ed521gs
2439696	2443104	2445712	T: nist521gs

armeabi; Cortex-A7 (410fc075); 2016 Broadcom BCM2836; 4 x 900MHz; `berry2`, `supercop-20210604`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
596059	606294	617958	T: kummer
926474	933209	945204	T: curve25519
1321065	1379146	1460532	T: nistp256
3470183	3506143	3539488	T: sclaus1024
11236095	11643481	11790584	T: claus
15870647	16010357	16116442	T: sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
593045	602253	615798	T: kummer
926023	932715	940291	T: curve25519
3568639	3593336	3603000	T: sclaus1024
4695297	4869236	5005629	T: nistp256
11340650	11638921	11839912	T: claus
15909068	16179189	16232908	T: sclaus2048

amd64; BW+AES (406f1); 2016 Intel Xeon E5-2609 v4; 8 x 1700MHz; `bolero`, `supercop-20220506`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
24588	25420	27984	T: jacfp127i
25792	26688	31012	T: kumjacfp127g
28360	29436	35376	T: prjfp127i
28180?	32376?	37508?	T: hecfp127i
31628	33056	36380	T: jacfp128bk
37640	37924	43296	T: gls254
39280	39448	44140	T: gls254prot
38456	39820	45752	T: hecfp128fkt
40300	41044	46316	T: curve2251
40440	41272	45988	T: hecfp128bk
38156	41440	45984	T: prjfp128bk
41000	43268	46268	T: hecfp128i
43520	46608	51084	T: ecfp256e
49304	49580	58872	T: k277taa
49492	51612	59664	T: ecfp256s
51372	52876	61552	T: ecfp256q
48252?	53236?	62840?	T: ecfp256h
55468	59280	66060	T: k298
60096	60800	69232	T: kummer
73288	74476	82648	T: k277mon
78200	82652	91916	T: gls1271
82776	83956	95596	T: kumfp127g
130188	135096	149968	T: kumfp128g
143320	147952	161396	T: curve25519
157132	163572	186188	T: ed448goldilocks
193244	200420	224812	T: sclaus1024
198460	206984	230792	T: surf127eps
203320	210888	231428	T: ecfp256i
248712	258988	288812	T: nistp256
628124	663608	707548	T: surf2113
942132	979728	1026328	T: ed521gs
994356	1031132	1064904	T: sclaus2048
1042852	1074800	1110968	T: claus
1086972	1129916	1172100	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
36156	36428	41940	T: gls254
39192	39240	39392	T: gls254prot
49244	53704	58948	T: k277taa
55284	55452	65836	T: k298
60364	63020	68968	T: kummer
73164	73264	83328	T: k277mon
86708	91332	103028	T: kumfp127g
93216	96296	107356	T: kumjacfp127g
96036	96348	105676	T: jacfp128bk
117200	121948	132768	T: prjfp128bk
120876	125448	135496	T: hecfp128bk
127920	132844	150784	T: hecfp128fkt
135508	140492	160040	T: kumfp128g
143008	147612	166496	T: curve25519
153812	159504	172492	T: curve2251
155180	160152	180432	T: jacfp127i
187456	192864	218240	T: hecfp127i
185368	194672	219028	T: prjfp127i
186184	195664	214964	T: ecfp256e
193544	199072	225748	T: gls1271
192640	199460	221920	T: surf127eps
192904	199956	221072	T: ecfp256q
193136	202444	223864	T: sclaus1024
201368	206128	229092	T: ecfp256i
233548	238596	263568	T: ecfp256h
252664	262600	290032	T: ecfp256s
276500	286984	315484	T: hecfp128i
479064	509576	532548	T: ed448goldilocks
631448	665560	689612	T: surf2113
632120	670704	701804	T: nistp256
953380	989436	1026480	T: ed521gs
973888	1004756	1058408	T: sclaus2048
1040488	1081068	1114844	T: claus
1084708	1121460	1167224	T: nist521gs

aarch64; A53+crypto (410fd034); 2015 NXP QorIQ LS1088; 8 x 1600MHz; `ten64`, `supercop-20210604`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
423808	423808	423808	T: kummer
469632	470272	470464	T: curve25519
482496	482816	483392	T: nistp256
566784	569280	570752	T: surf127eps
982080	992512	1003136	T: sclaus1024
3096256	3102272	3104896	T: ed521gs
3682432	3689344	3690944	T: nist521gs
4828992	4864960	4911872	T: sclaus2048
5186560	5188608	5210560	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
423488	423488	423744	T: kummer
476032	476096	476352	T: curve25519
568448	569472	570112	T: surf127eps
978944	988544	999424	T: sclaus1024
1651776	1651840	1658944	T: nistp256
3096704	3102656	3104000	T: ed521gs
3680448	3687104	3687360	T: nist521gs
4787136	4838016	4860352	T: sclaus2048
5176128	5177472	5180032	T: claus

amd64; Skylake (506e3); 2015 Intel Xeon E3-1220 v5; 4 x 3000MHz; `samba`, `supercop-20220506`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
20914	21195	22503	T: kumjacfp127g
20381	21596	22906	T: jacfp127i
23971	24815	26513	T: prjfp127i
26467	27794	29597	T: hecfp127i
29362	30190	31508	T: jacfp128bk
34215	35247	36857	T: prjfp128bk
36792	37032	37419	T: gls254
36310	37247	38398	T: hecfp128i
36994	37844	40048	T: hecfp128fkt
38016	38222	38974	T: curve2251
38036	38781	39588	T: hecfp128bk
38813	38849	38891	T: gls254prot
42132	42746	44037	T: ecfp256e
45692	45720	45760	T: k277taa
45058	45778	47147	T: ecfp256s
45569	46554	48222	T: ecfp256h
47827	48693	50947	T: ecfp256q
50173	50264	50956	T: kummer
52474	52567	52709	T: k298
69757	69823	69901	T: k277mon
69678	70597	71320	T: gls1271
78354	78413	78500	T: kumfp127g
110376	110423	110489	T: kumfp128g
125110	125388	125606	T: curve25519
152870	153083	153362	T: ed448goldilocks
175817	177084	178931	T: sclaus1024
182438	183033	183629	T: surf127eps
189268	190317	191746	T: ecfp256i
233987	234506	235182	T: nistp256
581091	584077	590116	T: surf2113
810090	810493	811974	T: ed521gs
887848	896855	923533	T: sclaus2048
936762	937518	938808	T: nist521gs
967712	968534	970174	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
35732	35783	35840	T: gls254
38559	38594	38643	T: gls254prot
45507	45531	45562	T: k277taa
50502	50640	54145	T: kummer
52257	52378	52509	T: k298
69684	69731	69782	T: k277mon
80660	80738	80821	T: kumfp127g
82615	82705	82787	T: kumjacfp127g
88170	88240	88323	T: jacfp128bk
108575	108701	108830	T: prjfp128bk
114838	115005	115173	T: hecfp128bk
115505	115558	115621	T: kumfp128g
119075	119229	119402	T: hecfp128fkt
124060	124160	124262	T: jacfp127i
134799	135148	135334	T: curve25519
145746	145828	145975	T: curve2251
165141	165294	165433	T: prjfp127i
167193	167317	167521	T: hecfp127i
168744	171585	172476	T: gls1271
175217	175358	175502	T: ecfp256e
174675	176508	177360	T: sclaus1024
177703	178296	178748	T: surf127eps
184841	184983	185182	T: ecfp256i
185217	185385	185580	T: ecfp256q
217625	217812	218051	T: ecfp256h
237809	237983	238228	T: ecfp256s
248097	248333	248621	T: hecfp128i
456281	456622	456889	T: ed448goldilocks
577999	578173	578442	T: nistp256
586934	590649	594453	T: surf2113
809506	809756	810839	T: ed521gs
891043	911181	934361	T: sclaus2048
936514	937023	938031	T: nist521gs
962205	964952	966399	T: claus

amd64; BW+AES (306d4); 2015 Intel Core i5-5350U; 2 x 1800MHz; unstable; `luft`, `supercop-20200702`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
48404	49352	50144	gls254
52468	52672	52840	gls254prot
63512	64496	68968	k277taa
76216	76816	79544	k298
84360	85840	87200	kummer
100828	107472	111260	k277mon
270472	296904	305632	curve25519
319844	329440	332672	ed448goldilocks
340196	368524	380824	surf127eps
350576	377888	391764	sclaus1024
499756	538332	550092	nistp256
1081420	1114288	1129628	surf2113
1183808	1233692	1254712	curve2251
1760260	1842984	1935860	sclaus2048
1803352	1914912	1921716	ed521gs
2170020	2264624	2362708	claus
2137104	2282876	2372176	nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
46760	47428	48676	gls254
49744	50640	52432	gls254prot
62616	63568	68740	k277taa
75128	75844	76364	k298
82916	84084	84520	kummer
98276	105660	111120	k277mon
283904	298712	307000	curve25519
339992	369712	375216	surf127eps
385252	389448	396764	sclaus1024
1027956	1053832	1055768	ed448goldilocks
1086304	1093652	1124016	surf2113
1213276	1219068	1260148	curve2251
1246396	1323436	1381256	nistp256
1783820	1888848	1921604	ed521gs
1850868	1907036	1995280	sclaus2048
2144440	2309164	2567204	nist521gs
2216580	2346548	2437328	claus

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1275 V3; 4 x 3500MHz; `titan0`, `supercop-20220506`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
33637	35147	36584	T: jacfp127i
35385	36018	36586	T: hecfp127i
35169	36381	37990	T: kumjacfp127g
37378	38791	40346	T: prjfp127i
41381	42780	46946	T: curve2251
43131	44568	46197	T: jacfp128bk
45154	45694	46350	T: gls254
47838	48771	49647	T: hecfp128i
49540	49601	49664	T: gls254prot
49583	50304	51216	T: ecfp256e
49288	51045	52725	T: prjfp128bk
49812	51096	55856	T: ecfp256s
49619	51859	55800	T: ecfp256h
51167	52577	53946	T: hecfp128bk
51306	52860	54151	T: hecfp128fkt
54926	56761	62585	T: ecfp256q
60425	60476	60531	T: kummer
63261	63304	63355	T: k277taa
70110	70213	70365	T: k298
91018	92088	93205	T: gls1271
97091	97164	97219	T: k277mon
110159	110304	110482	T: kumfp127g
144527	146907	148208	T: curve25519
155900	155963	156079	T: kumfp128g
176681	176906	177163	T: ed448goldilocks
213925	214640	215122	T: surf127eps
218608	220593	222147	T: sclaus1024
223346	225457	229171	T: ecfp256i
273184	273426	273766	T: nistp256
617883	620659	622265	T: surf2113
1032022	1033335	1039184	T: ed521gs
1098596	1106722	1114396	T: sclaus2048
1185660	1188264	1201472	T: nist521gs
1524251	1525401	1528271	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
40015	41549	41999	T: gls254
49339	49435	49479	T: gls254prot
60384	60444	60489	T: kummer
63152	63203	63253	T: k277taa
69918	69999	70065	T: k298
96964	96989	97031	T: k277mon
112275	112607	112860	T: kumfp127g
114339	114396	114468	T: jacfp128bk
120605	120687	120777	T: kumjacfp127g
141108	141358	145705	T: prjfp128bk
147634	147768	147991	T: hecfp128bk
155409	155574	155745	T: hecfp128fkt
156066	158271	158384	T: curve25519
159698	159913	162440	T: curve2251
162128	162163	162198	T: kumfp128g
185124	185303	185516	T: jacfp127i
206508	206644	206848	T: ecfp256e
204721	208189	208731	T: surf127eps
214760	214921	215136	T: ecfp256q
219105	219452	222954	T: gls1271
219661	219787	219984	T: ecfp256i
218045	220475	223508	T: sclaus1024
226907	227058	227286	T: prjfp127i
228620	228895	229122	T: hecfp127i
249856	250026	250218	T: ecfp256h
273024	273162	273380	T: ecfp256s
325812	331163	331556	T: hecfp128i
537092	537387	538032	T: ed448goldilocks
617276	618221	620083	T: surf2113
680877	681279	682055	T: nistp256
956012	956673	958458	T: claus
1031596	1032856	1039519	T: ed521gs
1112201	1113497	1114712	T: sclaus2048
1188866	1191389	1193524	T: nist521gs

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1220 v3; 4 x 3100MHz; `hiphop`, `supercop-20220506`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
28826	29481	31246	T: kumjacfp127g
30463	31228	31938	T: jacfp127i
32737	33537	34322	T: prjfp127i
34840	36472	39029	T: hecfp127i
38597	39379	40069	T: jacfp128bk
41073	42336	46073	T: curve2251
42940	43333	45878	T: prjfp128bk
44776	45277	45948	T: gls254
44652	45394	47797	T: hecfp128fkt
46114	46773	48201	T: ecfp256e
46647	47189	49438	T: hecfp128bk
46955	48455	51426	T: hecfp128i
48406	49183	51128	T: ecfp256h
49584	49701	49835	T: gls254prot
49120	50067	52095	T: ecfp256s
54065	54964	57405	T: ecfp256q
60432	60492	60570	T: kummer
63220	63291	63367	T: k277taa
70141	70252	70450	T: k298
90904	91928	92638	T: gls1271
97115	97191	97311	T: k277mon
109858	109962	110066	T: kumfp127g
144456	144548	147220	T: curve25519
157097	157222	157331	T: kumfp128g
176643	176963	177382	T: ed448goldilocks
213351	214187	215065	T: surf127eps
218171	219732	221607	T: sclaus1024
222921	224124	225489	T: ecfp256i
272998	273404	281510	T: nistp256
618119	620972	623686	T: surf2113
1032365	1033180	1034069	T: ed521gs
1102515	1113052	1160846	T: sclaus2048
1184626	1186002	1187676	T: nist521gs
1522544	1523222	1524943	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
40059	40569	40662	T: gls254
49434	49521	49608	T: gls254prot
60408?	60506?	96147?	T: kummer
63150	63184	63225	T: k277taa
69962	70062	70166	T: k298
96972	97091	97208	T: k277mon
112345	112441	112559	T: kumfp127g
114100	114170	114261	T: jacfp128bk
120886	120964	121072	T: kumjacfp127g
140899	141042	141195	T: prjfp128bk
144967	145108	145277	T: hecfp128bk
155673	155901	156437	T: hecfp128fkt
155992	156071	158679	T: curve25519
158397	159272	160692	T: curve2251
163145	163214	163362	T: kumfp128g
185198	185574	186647	T: jacfp127i
205455	205578	205896	T: ecfp256e
207607	208324	209164	T: surf127eps
214781	214958	215182	T: ecfp256q
218932	219315	222458	T: gls1271
219693	219816	220057	T: ecfp256i
221215	224153	225103	T: sclaus1024
227258	227550	227800	T: prjfp127i
230806	231008	231273	T: hecfp127i
249957	250107	250410	T: ecfp256h
273147	273380	273744	T: ecfp256s
325154	325544	325942	T: hecfp128i
537140	537412	537880	T: ed448goldilocks
615654	620964	626760	T: surf2113
680707	681249	682505	T: nistp256
956166	957096	957906	T: claus
1032354	1033139	1034192	T: ed521gs
1111471	1123033	1168502	T: sclaus2048
1184698	1186120	1188217	T: nist521gs

amd64; Bulldozer (600f20); 2012 AMD FX-8350; 4 x 4000MHz; `saber214`, `supercop-20220506`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
44535	45420	46259	T: jacfp127i
45814	46700	47602	T: kumjacfp127g
51184	52079	53162	T: prjfp127i
51878	52625	53627	T: hecfp127i
64568	65151	67359	T: curve2251
67367	68149	69026	T: jacfp128bk
70798	73246	77900	T: ecfp256e
74728	77484	81982	T: ecfp256h
74929	77661	81294	T: ecfp256s
77522	78164	79324	T: prjfp128bk
78016	78865	80112	T: hecfp128bk
78072	78890	79997	T: hecfp128i
78656	79525	80480	T: hecfp128fkt
81081	83608	88465	T: ecfp256q
90694	91689	92844	T: gls254
104738	104739	104746	T: gls254prot
113410	114917	116103	T: gls1271
138541	138563	138579	T: k277taa
155609	155746	161545	T: kumfp127g
167168	167212	167362	T: k298
174711	174730	174763	T: curve25519
204601	204629	204667	T: kummer
211858	211870	211905	T: k277mon
254643	254723	256395	T: kumfp128g
341461	343121	345174	T: ecfp256i
366960	367256	367994	T: ed448goldilocks
375876	377590	379151	T: surf127eps
423492	427877	432411	T: sclaus1024
632720	633103	633417	T: nistp256
670940	673807	675667	T: surf2113
1837351	1838964	1843897	T: ed521gs
2102266	2119035	2138022	T: sclaus2048
2110041	2122080	2150117	T: nist521gs
2547143	2553838	2562927	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
85157	87074	87496	T: gls254
104657	104710	104710	T: gls254prot
138448	138450	138454	T: k277taa
160315	160332	160380	T: kumfp127g
161566	161806	162992	T: kumjacfp127g
167178	167207	167232	T: k298
186758	186780	186805	T: curve25519
197239	197262	197296	T: kummer
199385	199442	199554	T: jacfp128bk
211804	211805	211809	T: k277mon
241458	241958	242807	T: curve2251
247505	247849	248027	T: prjfp128bk
251825	251879	251979	T: hecfp128bk
263257	263454	263563	T: hecfp128fkt
264219	264395	264564	T: jacfp127i
266869	266950	267057	T: kumfp128g
273908	277064	281513	T: gls1271
320313	320423	320747	T: ecfp256e
335580	336201	337003	T: ecfp256q
338763	338927	339239	T: ecfp256i
357062	357242	357461	T: hecfp127i
359231	359349	359560	T: prjfp127i
373913	374164	379026	T: surf127eps
403004	403319	403801	T: ecfp256h
422663	422988	423410	T: ecfp256s
427272	428426	430504	T: sclaus1024
562251	562477	562600	T: hecfp128i
668065	671925	673795	T: surf2113
1158568	1158666	1158757	T: ed448goldilocks
1249605	1249617	1249753	T: nistp256
1834307	1839049	1844432	T: ed521gs
2098033	2101297	2131841	T: nist521gs
2108715	2117688	2120005	T: sclaus2048
2553685	2556544	2566788	T: claus

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1275 V2; 4 x 3500MHz; `hydra8`, `supercop-20220506`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
31995	33191	34393	T: jacfp127i
32509	33315	35003	T: kumjacfp127g
36066	38254	41045	T: prjfp127i
40716	41581	43420	T: jacfp128bk
40031	41649	43406	T: hecfp127i
50794	51809	53964	T: ecfp256e
51487	52245	53084	T: hecfp128fkt
50698	53249	55900	T: prjfp128bk
53618	54415	57117	T: ecfp256h
52529	55446	58125	T: hecfp128bk
54740	55803	57842	T: ecfp256s
55422	57317	58838	T: hecfp128i
57420	57920	61234	T: curve2251
58764	59942	62775	T: ecfp256q
73769	74724	76141	T: gls254
88751	88961	89056	T: kummer
96428	97478	98440	T: gls1271
106453	106511	106591	T: gls254prot
117024	117183	117270	T: kumfp127g
145032	145107	145429	T: curve25519
164999	165207	165344	T: kumfp128g
175113	176257	176369	T: k277taa
181230	181597	183233	T: k298
235217	235903	236531	T: surf127eps
242174	243251	244692	T: ecfp256i
257953	257955	257963	T: k277mon
266784	269074	271795	T: sclaus1024
312040	312347	313112	T: nistp256
655672	658945	660239	T: surf2113
1099219	1100408	1102521	T: ed521gs
1237280	1238912	1241388	T: nist521gs
1361536	1368532	1379654	T: sclaus2048
1599583	1603112	1606529	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
69578	72194	72546	T: gls254
88470	88638	88801	T: kummer
106292	106324	106375	T: gls254prot
119460	119589	119708	T: kumfp127g
124148	124266	124448	T: jacfp128bk
126536	126673	126829	T: kumjacfp127g
156716	156812	157249	T: curve25519
157900	158053	158286	T: prjfp128bk
162349	162462	162610	T: hecfp128bk
168485	168658	168841	T: hecfp128fkt
171050	171173	171299	T: kumfp128g
176001	176063	176126	T: k277taa
180884	180987	181073	T: k298
190532	190859	194843	T: jacfp127i
223138	224733	225025	T: curve2251
225093	225330	225573	T: ecfp256e
227263	228275	228920	T: surf127eps
235470	235656	235831	T: ecfp256q
238973	239168	239496	T: ecfp256i
239008	239407	240507	T: prjfp127i
235393	239533	241664	T: gls1271
244890	245206	245475	T: hecfp127i
257914	257917	257932	T: k277mon
272846	273288	276524	T: sclaus1024
275862	275927	276122	T: ecfp256h
297915	298065	298304	T: ecfp256s
365659	365890	366333	T: hecfp128i
653902	655593	657750	T: surf2113
770215	771170	771875	T: nistp256
1100817	1101846	1103443	T: ed521gs
1236277	1237619	1241012	T: nist521gs
1323848	1361676	1366685	T: sclaus2048
1596776	1598316	1600840	T: claus

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1265L V2; 4 x 2500MHz; `hedera`, `supercop-20210326`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
28909	29396	31004	T: jacfp127i
30070	30732	32520	T: kumjacfp127g
33819	34472	36539	T: hecfp127i
36486	37438	38776	T: prjfp127i
41201	42070	43565	T: jacfp128bk
48201	49198	50624	T: prjfp128bk
49217	50263	51237	T: hecfp128bk
49911	50717	51482	T: hecfp128fkt
49789	50753	51723	T: hecfp128i
50197	50808	51753	T: ecfp256e
53146	53791	55988	T: ecfp256h
56683	57098	59815	T: curve2251
57747	58279	59159	T: ecfp256s
58064	58899	61154	T: ecfp256q
74721	75804	76899	T: gls254
88697	88780	88991	T: kummer
96271	97485	99181	T: gls1271
106336	106406	106484	T: gls254prot
114137	114399	115068	T: kumfp127g
145078	145412	145504	T: curve25519
164848	164924	165097	T: kumfp128g
174548	175860	175937	T: k277taa
180998	181074	181254	T: k298
210970	211547	211882	T: ed448goldilocks
235920	236652	237958	T: surf127eps
242156	243312	244798	T: ecfp256i
257518	257522	257546	T: k277mon
265772	268328	270886	T: sclaus1024
291564	300634	312125	T: hector
319923	321152	322178	T: nistp256
578681	581128	582779	T: surf2113
1130495	1130900	1131611	T: ed521gs
1317678	1317847	1318914	T: nist521gs
1356204	1369352	1381427	T: sclaus2048
1594291	1596763	1600250	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
69962	70177	72435	T: gls254
88481	88569	88771	T: kummer
106240	106267	106320	T: gls254prot
116592	116673	116728	T: kumfp127g
124508	124588	124676	T: jacfp128bk
126848	126978	127086	T: kumjacfp127g
157341	157509	157688	T: prjfp128bk
156807	159451	160595	T: curve25519
161145	161262	161395	T: hecfp128bk
167278	167388	167502	T: hecfp128fkt
170626	170736	170839	T: kumfp128g
174307	175485	175560	T: k277taa
180306	180349	180412	T: k298
190558	190724	191176	T: jacfp127i
222999	223430	224790	T: curve2251
225426	225598	225763	T: ecfp256e
230305	230733	231179	T: surf127eps
234913	235082	235332	T: ecfp256q
234605	236070	239408	T: gls1271
238259	238493	238847	T: prjfp127i
238952	239103	239309	T: ecfp256i
244592	244829	245150	T: hecfp127i
257491	257500	257501	T: k277mon
268418	272793	274235	T: sclaus1024
276317	276426	276529	T: ecfp256h
297445	297545	297702	T: ecfp256s
365520	365678	365977	T: hecfp128i
579552	580206	580761	T: surf2113
628898	629615	631385	T: ed448goldilocks
765125	767126	769017	T: nistp256
996635	1034721	1045662	T: hector
1125008	1125449	1130459	T: ed521gs
1317314	1317449	1317705	T: nist521gs
1356801	1382093	1391271	T: sclaus2048
1594837	1595309	1596323	T: claus

amd64; SB+AES (206d7); 2012 Intel Xeon E5-2660; 8 x 2200MHz; unstable; `gcc123`, `supercop-20220213`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
31943	32708	33506	T: jacfp127i
32953	33765	35040	T: kumjacfp127g
37608	38623	39513	T: hecfp127i
39004	40504	42276	T: prjfp127i
45798	46604	49017	T: jacfp128bk
54528	55306	56314	T: ecfp256e
55935	57092	58739	T: prjfp128bk
56528	57439	58649	T: hecfp128fkt
57372	58038	60010	T: ecfp256h
58935	59355	62473	T: curve2251
58172	59686	61610	T: hecfp128i
57729	59694	61632	T: hecfp128bk
59213	60262	62540	T: ecfp256s
63294	64112	66013	T: ecfp256q
74267	75189	76426	T: gls254
89282	89333	89393	T: kummer
101621	102757	104070	T: gls1271
107786	107990	108100	T: gls254prot
120356	120660	120847	T: kumfp127g
147437	149335	150231	T: curve25519
176693	176754	176821	T: k277taa
183385	183523	183801	T: k298
183493	184494	184712	T: kumfp128g
216977	217416	218118	T: ed448goldilocks
258378	258897	259109	T: k277mon
264599	265793	267654	T: ecfp256i
271269	272151	273008	T: surf127eps
285659	288427	291181	T: sclaus1024
346611	347055	348467	T: nistp256
632059	635140	636537	T: surf2113
1201183	1202697	1213390	T: ed521gs
1437670	1438873	1440254	T: nist521gs
1453921	1463199	1474175	T: sclaus2048
1707624	1712069	1716365	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
68567	70640	70910	T: gls254
89053	89079	89114	T: kummer
107718	107843	108042	T: gls254prot
123422	123608	123778	T: kumfp127g
131022	131115	131347	T: kumjacfp127g
139870	140122	152456	T: jacfp128bk
158914	159113	159230	T: curve25519
176460	176503	176544	T: k277taa
178453	178678	178968	T: prjfp128bk
182177	182418	185208	T: hecfp128bk
182474	182579	182699	T: k298
189273	189532	200762	T: hecfp128fkt
190389	191431	191674	T: kumfp128g
200096	200414	213508	T: jacfp127i
231825	232605	232832	T: curve2251
248092	248254	248472	T: ecfp256e
249077	250480	251963	T: gls1271
257409	257555	257723	T: ecfp256q
258321	258857	259061	T: k277mon
260327	260627	261091	T: prjfp127i
261160	261279	261406	T: ecfp256i
264886	265400	269808	T: hecfp127i
267683	268185	269010	T: surf127eps
290366	291197	293939	T: sclaus1024
305106	305231	305409	T: ecfp256h
324559	324747	324996	T: ecfp256s
412908	413317	413695	T: hecfp128i
621379	623817	629240	T: surf2113
648753	651584	670955	T: ed448goldilocks
826719	827216	827670	T: nistp256
1207103	1210696	1213881	T: ed521gs
1437472	1438062	1439620	T: nist521gs
1444699	1466069	1478225	T: sclaus2048
1703400	1711775	1715637	T: claus

armeabi; Cortex-A9+NEON (412fc09a); 2011 Freescale i.MX6 Quad; 4 x 1200MHz; unstable; `novena`, `supercop-20220506`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
383633	403235	426836	T: kummer
568432	579721	605953	T: curve25519
1136097	1225306	1320114	T: nistp256
3170271	3319084	3441142	T: sclaus1024
10395810	10675708	12763892	T: claus
13118323?	15156764?	17482296?	T: sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
377632	394434	418035	T: kummer
567769	587250	684860	T: curve25519
3175872	3314684	3482698	T: sclaus1024
3784324	4125553	4561590	T: nistp256
10384521	10702273	10950137	T: claus
12688797?	16762633?	17448692?	T: sclaus2048

armeabi; Cortex-A9+NEON (412fc09a); 2011 Freescale i.MX6 Quad; 4 x 1200MHz; `novenablue`, `supercop-20200702`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
355418	355433	355453	kummer
567411	567423	567474	curve25519
1830608	1831928	1841365	nistp256
3530954	3571191	3610489	sclaus1024
16821840	16921770	17041862	sclaus2048
17108323	17116525	17123909	claus

Cycles to compute a shared secret
25%	50%	75%	system
355290	355292	355314	kummer
567279	567290	567304	curve25519
3589111	3605090	3620752	sclaus1024
6235333	6247947	6251411	nistp256
17073072	17079283	17089253	claus
17075724	17176722	17304846	sclaus2048

mipso32; Octeon II (cnmips64v2); 2011 Cavium Octeon II CN6120; 2 x 2000MHz; `erpro8fsf2`, `supercop-20220213`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
1470992	1471006	1473758	T: kummer
1999782	1999822	2008112	T: curve25519
3460452	3464152	3494426	T: nistp256
4862008	4903346	5012496	T: surf127eps
9011088	9088628	9163840	T: sclaus1024
44725298	44995590	45330454	T: sclaus2048
54624848	54748844	54873548	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
1470600	1470614	1470614	T: kummer
1999370	1999384	2001402	T: curve25519
4858614	4913324	5012660	T: surf127eps
8893818	9066186	9103512	T: sclaus1024
11580548	11609924	11704890	T: nistp256
44820102	44989178	45145550	T: sclaus2048
54821082	54870326	54982680	T: claus

mipso32; Octeon II (cnmips64v2); 2011 Cavium Octeon II CN6120; 2 x 2000MHz; `gcc23`, `supercop-20220506`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
1470974	1471016	1472676	T: kummer
1999190	1999190	2000622	T: curve25519
3445112	3457414	3461870	T: nistp256
4842432	4861172	4867094	T: surf127eps
8990814	9085482	9171120	T: sclaus1024
44620218	44949186	45248108	T: sclaus2048
54505024	54612440	54716466	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
1470626	1470630	1470630	T: kummer
1998908	1998908	1999896	T: curve25519
4830168	4842474	4861988	T: surf127eps
9005814	9044176	9159864	T: sclaus1024
11542328	11570570	11603418	T: nistp256
44791748	45059326	45496830	T: sclaus2048
54280200	54598346	54663778	T: claus

amd64; C2 45nm (10676); 2007 Intel Xeon X5450; 8 x 2992MHz; unstable; `gcc14`, `supercop-20220506`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
45073	47463	50135	T: jacfp127i
47041	48352	49377	T: kumjacfp127g
51723	53951	57038	T: prjfp127i
53002	55177	59391	T: hecfp127i
71369	72558	76668	T: ecfp256e
77419	78996	84435	T: ecfp256h
78095	79351	80571	T: jacfp128bk
79688	81591	86347	T: ecfp256s
88494	89081	91698	T: ecfp256q
89987	92678	95313	T: prjfp128bk
90695	93092	96851	T: hecfp128fkt
91464	93688	97172	T: hecfp128i
91884	93931	96811	T: hecfp128bk
122081	124406	126622	T: gls1271
127352	128298	131045	T: curve2251
178621	178639	178774	T: kumfp127g
299212	299279	299300	T: curve25519
314856	315067	315465	T: kumfp128g
329748	330281	330858	T: ed448goldilocks
384083	386835	388905	T: ecfp256i
413326	415894	420963	T: surf127eps
422448	422696	424925	T: kummer
422389	426879	430417	T: sclaus1024
592353	599624	599809	T: nistp256
703975	707187	707993	T: surf2113
1651276	1654847	1665749	T: ed521gs
1965828	1968124	1970593	T: nist521gs
2141649	2158462	2174320	T: sclaus2048
2531594	2536774	2542306	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
183308	183339	183401	T: kumfp127g
187644	188022	188184	T: kumjacfp127g
244882	244967	245135	T: jacfp128bk
292653	292810	292871	T: jacfp127i
298596	298922	299590	T: curve25519
301634	301818	301972	T: prjfp128bk
307377	307524	307663	T: hecfp128bk
315724	316398	332895	T: gls1271
318241	318313	318421	T: hecfp128fkt
327094	327144	327284	T: kumfp128g
362120	362446	362793	T: ecfp256e
377991	378292	378707	T: ecfp256q
381459	381554	381707	T: prjfp127i
383653	383881	384037	T: ecfp256i
388709	388774	388844	T: hecfp127i
412903	415509	419428	T: surf127eps
422428	422854	424362	T: kummer
424342	428316	440575	T: sclaus1024
455103	455540	455801	T: ecfp256h
470134	470272	470478	T: ecfp256s
519804	523960	528188	T: curve2251
694179	694320	694727	T: hecfp128i
701889	703404	704125	T: surf2113
1022552	1023096	1026174	T: ed448goldilocks
1175789	1175997	1177498	T: nistp256
1650753	1654641	1665087	T: ed521gs
1965264	1967089	1969059	T: nist521gs
2127175	2145573	2206421	T: sclaus2048
2537381	2538852	2573470	T: claus

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2404MHz; `margaux`, `supercop-20220506`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
41887	42996	44689	T: jacfp127i
43865	45175	46455	T: kumjacfp127g
48026	49318	51701	T: prjfp127i
49919	51679	54236	T: hecfp127i
74958	76222	77368	T: jacfp128bk
77485	78207	79759	T: ecfp256e
82863	83458	85025	T: ecfp256h
84051	84917	86249	T: ecfp256s
87981	89312	90934	T: prjfp128bk
88430	90552	93172	T: hecfp128bk
88974	90570	93427	T: hecfp128i
89199	90771	93712	T: hecfp128fkt
90493	91525	93049	T: ecfp256q
126201	127832	129176	T: gls1271
131760	132846	135609	T: curve2251
178795	178878	178985	T: kumfp127g
300192	301403	302425	T: curve25519
314730	314938	315180	T: kumfp128g
345050	345724	346796	T: ed448goldilocks
387780	389344	391450	T: ecfp256i
421852	426405	430360	T: sclaus1024
428379	430954	431872	T: kummer
430610	432379	433903	T: surf127eps
493841	495056	497115	T: nistp256
707495	711520	713861	T: surf2113
1684659	1686784	1690900	T: ed521gs
1961216	1964124	1966514	T: nist521gs
2150568	2169713	2186433	T: sclaus2048
2543920	2551253	2590229	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
183326	183367	183534	T: kumfp127g
187766	188158	188287	T: kumjacfp127g
243799	243974	244147	T: jacfp128bk
292249	292381	292659	T: jacfp127i
300639	301514	302074	T: curve25519
301871	301937	302075	T: prjfp128bk
307782	307874	308088	T: hecfp128bk
314737	317098	322188	T: gls1271
318275	318491	318792	T: hecfp128fkt
327017	327159	327324	T: kumfp128g
366127	366434	366882	T: ecfp256e
381376	381552	381748	T: prjfp127i
382271	382569	383032	T: ecfp256q
387243	387400	387571	T: ecfp256i
389428	389624	390460	T: hecfp127i
421353	423825	442261	T: sclaus1024
427824	429971	431287	T: kummer
427793	430637	431718	T: surf127eps
458397	458634	458912	T: ecfp256h
474824	475181	475579	T: ecfp256s
545868	547486	551403	T: curve2251
693928	694211	694565	T: hecfp128i
699997	709759	711290	T: surf2113
1029159	1030521	1031363	T: ed448goldilocks
1160333	1161107	1162255	T: nistp256
1683664	1685725	1687535	T: ed521gs
1959610	1962117	1967104	T: nist521gs
2170203	2174419	2183777	T: sclaus2048
2526743	2546676	2604215	T: claus

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2394MHz; `latour`, `supercop-20201130`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
41814	42840	44001	T: jacfp127i
43614	44676	46188	T: kumjacfp127g
48816	49797	51165	T: prjfp127i
49536	51093	53487	T: hecfp127i
74205	75240	76527	T: jacfp128bk
76086	76797	78336	T: ecfp256e
81711	82269	83826	T: ecfp256h
83106	84024	85320	T: ecfp256s
87480	88587	90063	T: prjfp128bk
88011	89730	92655	T: hecfp128bk
88074	89739	92124	T: hecfp128i
89172	90090	91323	T: ecfp256q
88695	90423	92889	T: hecfp128fkt
131796	132273	134325	T: curve2251
178803	178830	179568	T: kumfp127g
296073	296397	297711	T: curve25519
315045	315459	316053	T: kumfp128g
329778	330426	331290	T: ed448goldilocks
386811	388890	392112	T: ecfp256i
413433	415692	419049	T: surf127eps
423441	423486	423549	T: kummer
423990	428571	432324	T: sclaus1024
592785	600993	602676	T: nistp256
751266	755028	756891	T: surf2113
1655343	1657602	1663704	T: ed521gs
1998747	2002014	2011401	T: nist521gs
2160747	2175453	2191986	T: sclaus2048
2543508	2550222	2559150	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
183384	183411	183411	T: kumfp127g
188046	188361	188451	T: kumjacfp127g
243351	243567	243639	T: jacfp128bk
292230	292473	292662	T: jacfp127i
296640	297639	297720	T: curve25519
299241	299403	300294	T: prjfp128bk
307611	307755	307872	T: hecfp128bk
318600	318717	318897	T: hecfp128fkt
327852	328167	328644	T: kumfp128g
367776	368136	368640	T: ecfp256e
380538	380673	380880	T: prjfp127i
381825	382068	382302	T: ecfp256q
386514	386766	387054	T: ecfp256i
389520	389556	389691	T: hecfp127i
411264	413793	416106	T: surf127eps
423396	423423	423504	T: kummer
429975	433134	438012	T: sclaus1024
459072	459234	459450	T: ecfp256h
474966	475245	475497	T: ecfp256s
548262	550845	555012	T: curve2251
694503	694620	694746	T: hecfp128i
748431	751878	753390	T: surf2113
1019178	1024416	1029906	T: ed448goldilocks
1173393	1173609	1173906	T: nistp256
1650006	1650942	1658637	T: ed521gs
1998486	2000583	2010285	T: nist521gs
2196918	2209878	2213046	T: sclaus2048
2544885	2550501	2563587	T: claus

Version

This is version 2022.06.19 of the results-dh.html web page. This web page is in the public domain.

eBACS: ECRYPT Benchmarking of Cryptographic Systems

Measurements of public-key Diffie–Hellman secret-sharing systems, indexed by machine

Sizes across machines

aarch64; Firestorm (610f0230); 2020 Apple M1; 4 x 3200MHz; unstable; minimac, supercop-20211108

amd64; Zen3 (a20f10); 2020 AMD Ryzen 9 5950X; 16 x 3400MHz; zen3, supercop-20220213

amd64; TigerLake (806c1); 2020 Intel Core i7-1165G7; 4 x 2800MHz; unstable; pascalinspiron75062n1, supercop-20210125

amd64; IceLake (706e5); 2020 Intel Core i5-1030NG7; 4 x 1100MHz; icelake, supercop-20200826

aarch64; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; pi4b, supercop-20220506

ppc64; POWER9 (004e1203); 2019? IBM 02CY642; 22 x 3800MHz; power9, supercop-20210326

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; colossus6, supercop-20210125

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; colossus7, supercop-20210125

amd64; Zen (810f81); 2019 AMD Ryzen Embedded R1606G; 2 x 2600MHz; unstable; ghf51, supercop-20200702

amd64; CometLake (806ec); 2019 Intel Core i3-10110U; 2 x 2100MHz; comet, supercop-20220213

amd64; CascadeLake (50657); 2019 Intel Xeon Gold 6230; 40 x 2100MHz; unstable; cel02, supercop-20201130

amd64; CascadeLake (50657); 2019 Intel Core i9-10980XE; 18 x 3000MHz; avx512imath, supercop-20210125

aarch64; Skylark (503f0002); 2018 Ampere eMAG 8180; 32 x 3300MHz; gcc185, supercop-20211108

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; pi3aplus, supercop-20220506

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; pi3bplus, supercop-20210604

amd64; Zen (810f10); 2018 AMD Ryzen 5 2400G; 4 x 3600MHz; unstable; gcc67, supercop-20210125

amd64; CoffeeLake (906ea); 2018 Intel Xeon E-2124; 4 x 3300MHz; r24000, supercop-20211108

riscv64; U54 (sifive,u54-mc); 2017 SiFive Freedom U540; 4 x 1000MHz; riscvunleashed000, supercop-20210326

amd64; Zen (800f12); 2017 AMD EPYC 7501; 32 x 2000MHz; unstable; colossus5, supercop-20210125

amd64; Zen (800f12); 2017 AMD EPYC 7451; 48 x 2300MHz; unstable; firefly, supercop-20201130

amd64; Zen (800f11); 2017 AMD Ryzen 7 1700; 8 x 3000MHz; rumba7, supercop-20220506

amd64; Zen (800f11); 2017 AMD Ryzen 5 1600; 6 x 3200MHz; rumba5, supercop-20220506

amd64; Zen (800f11); 2017 AMD Ryzen 3 1200; 4 x 3100MHz; rumba3, supercop-20200906

amd64; KabyLake (906e9); 2017 Intel Xeon E3-1220 v6; 4 x 3000MHz; kizomba, supercop-20220506

amd64; KabyLake (806e9); 2017 Intel Core i7-7567U; 2 x 3500MHz; unstable; intelnuci7, supercop-20211108

aarch64; A57+crypto (411fd072); 2016 AMD Opteron A1100; 8 x 2000MHz; warbear0, supercop-20200826

armeabi; Cortex-A7 (410fc075); 2016 Broadcom BCM2836; 4 x 900MHz; berry2, supercop-20210604

amd64; BW+AES (406f1); 2016 Intel Xeon E5-2609 v4; 8 x 1700MHz; bolero, supercop-20220506

aarch64; A53+crypto (410fd034); 2015 NXP QorIQ LS1088; 8 x 1600MHz; ten64, supercop-20210604

amd64; Skylake (506e3); 2015 Intel Xeon E3-1220 v5; 4 x 3000MHz; samba, supercop-20220506

amd64; BW+AES (306d4); 2015 Intel Core i5-5350U; 2 x 1800MHz; unstable; luft, supercop-20200702

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1275 V3; 4 x 3500MHz; titan0, supercop-20220506

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1220 v3; 4 x 3100MHz; hiphop, supercop-20220506

amd64; Bulldozer (600f20); 2012 AMD FX-8350; 4 x 4000MHz; saber214, supercop-20220506

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1275 V2; 4 x 3500MHz; hydra8, supercop-20220506

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1265L V2; 4 x 2500MHz; hedera, supercop-20210326

amd64; SB+AES (206d7); 2012 Intel Xeon E5-2660; 8 x 2200MHz; unstable; gcc123, supercop-20220213

armeabi; Cortex-A9+NEON (412fc09a); 2011 Freescale i.MX6 Quad; 4 x 1200MHz; unstable; novena, supercop-20220506

armeabi; Cortex-A9+NEON (412fc09a); 2011 Freescale i.MX6 Quad; 4 x 1200MHz; novenablue, supercop-20200702

mipso32; Octeon II (cnmips64v2); 2011 Cavium Octeon II CN6120; 2 x 2000MHz; erpro8fsf2, supercop-20220213

mipso32; Octeon II (cnmips64v2); 2011 Cavium Octeon II CN6120; 2 x 2000MHz; gcc23, supercop-20220506

amd64; C2 45nm (10676); 2007 Intel Xeon X5450; 8 x 2992MHz; unstable; gcc14, supercop-20220506

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2404MHz; margaux, supercop-20220506

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2394MHz; latour, supercop-20201130

Version

aarch64; Firestorm (610f0230); 2020 Apple M1; 4 x 3200MHz; unstable; `minimac`, `supercop-20211108`

amd64; Zen3 (a20f10); 2020 AMD Ryzen 9 5950X; 16 x 3400MHz; `zen3`, `supercop-20220213`

amd64; TigerLake (806c1); 2020 Intel Core i7-1165G7; 4 x 2800MHz; unstable; `pascalinspiron75062n1`, `supercop-20210125`

amd64; IceLake (706e5); 2020 Intel Core i5-1030NG7; 4 x 1100MHz; `icelake`, `supercop-20200826`

aarch64; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; `pi4b`, `supercop-20220506`

ppc64; POWER9 (004e1203); 2019? IBM 02CY642; 22 x 3800MHz; `power9`, `supercop-20210326`

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; `colossus6`, `supercop-20210125`

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; `colossus7`, `supercop-20210125`

amd64; Zen (810f81); 2019 AMD Ryzen Embedded R1606G; 2 x 2600MHz; unstable; `ghf51`, `supercop-20200702`

amd64; CometLake (806ec); 2019 Intel Core i3-10110U; 2 x 2100MHz; `comet`, `supercop-20220213`

amd64; CascadeLake (50657); 2019 Intel Xeon Gold 6230; 40 x 2100MHz; unstable; `cel02`, `supercop-20201130`

amd64; CascadeLake (50657); 2019 Intel Core i9-10980XE; 18 x 3000MHz; `avx512imath`, `supercop-20210125`

aarch64; Skylark (503f0002); 2018 Ampere eMAG 8180; 32 x 3300MHz; `gcc185`, `supercop-20211108`

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; `pi3aplus`, `supercop-20220506`

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; `pi3bplus`, `supercop-20210604`

amd64; Zen (810f10); 2018 AMD Ryzen 5 2400G; 4 x 3600MHz; unstable; `gcc67`, `supercop-20210125`

amd64; CoffeeLake (906ea); 2018 Intel Xeon E-2124; 4 x 3300MHz; `r24000`, `supercop-20211108`

riscv64; U54 (sifive,u54-mc); 2017 SiFive Freedom U540; 4 x 1000MHz; `riscvunleashed000`, `supercop-20210326`

amd64; Zen (800f12); 2017 AMD EPYC 7501; 32 x 2000MHz; unstable; `colossus5`, `supercop-20210125`

amd64; Zen (800f12); 2017 AMD EPYC 7451; 48 x 2300MHz; unstable; `firefly`, `supercop-20201130`

amd64; Zen (800f11); 2017 AMD Ryzen 7 1700; 8 x 3000MHz; `rumba7`, `supercop-20220506`

amd64; Zen (800f11); 2017 AMD Ryzen 5 1600; 6 x 3200MHz; `rumba5`, `supercop-20220506`

amd64; Zen (800f11); 2017 AMD Ryzen 3 1200; 4 x 3100MHz; `rumba3`, `supercop-20200906`

amd64; KabyLake (906e9); 2017 Intel Xeon E3-1220 v6; 4 x 3000MHz; `kizomba`, `supercop-20220506`

amd64; KabyLake (806e9); 2017 Intel Core i7-7567U; 2 x 3500MHz; unstable; `intelnuci7`, `supercop-20211108`

aarch64; A57+crypto (411fd072); 2016 AMD Opteron A1100; 8 x 2000MHz; `warbear0`, `supercop-20200826`

armeabi; Cortex-A7 (410fc075); 2016 Broadcom BCM2836; 4 x 900MHz; `berry2`, `supercop-20210604`

amd64; BW+AES (406f1); 2016 Intel Xeon E5-2609 v4; 8 x 1700MHz; `bolero`, `supercop-20220506`

aarch64; A53+crypto (410fd034); 2015 NXP QorIQ LS1088; 8 x 1600MHz; `ten64`, `supercop-20210604`

amd64; Skylake (506e3); 2015 Intel Xeon E3-1220 v5; 4 x 3000MHz; `samba`, `supercop-20220506`

amd64; BW+AES (306d4); 2015 Intel Core i5-5350U; 2 x 1800MHz; unstable; `luft`, `supercop-20200702`

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1275 V3; 4 x 3500MHz; `titan0`, `supercop-20220506`

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1220 v3; 4 x 3100MHz; `hiphop`, `supercop-20220506`

amd64; Bulldozer (600f20); 2012 AMD FX-8350; 4 x 4000MHz; `saber214`, `supercop-20220506`

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1275 V2; 4 x 3500MHz; `hydra8`, `supercop-20220506`

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1265L V2; 4 x 2500MHz; `hedera`, `supercop-20210326`

amd64; SB+AES (206d7); 2012 Intel Xeon E5-2660; 8 x 2200MHz; unstable; `gcc123`, `supercop-20220213`

armeabi; Cortex-A9+NEON (412fc09a); 2011 Freescale i.MX6 Quad; 4 x 1200MHz; unstable; `novena`, `supercop-20220506`

armeabi; Cortex-A9+NEON (412fc09a); 2011 Freescale i.MX6 Quad; 4 x 1200MHz; `novenablue`, `supercop-20200702`

mipso32; Octeon II (cnmips64v2); 2011 Cavium Octeon II CN6120; 2 x 2000MHz; `erpro8fsf2`, `supercop-20220213`

mipso32; Octeon II (cnmips64v2); 2011 Cavium Octeon II CN6120; 2 x 2000MHz; `gcc23`, `supercop-20220506`

amd64; C2 45nm (10676); 2007 Intel Xeon X5450; 8 x 2992MHz; unstable; `gcc14`, `supercop-20220506`

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2404MHz; `margaux`, `supercop-20220506`

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2394MHz; `latour`, `supercop-20201130`