VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

General information:	Introduction	eBASH	eBASC	eBAEAD	eBATS	SUPERCOP	XBX	Computers

How to submit new software:	Tips	hash	stream	aead	dh	kem	encrypt	sign

List of primitives measured:	lwc	sha3	hash	stream	lwc	caesar	aead	dh	kem	encrypt	sign

Measurements indexed by machine:	lwc	sha3	hash	stream	lwc	caesar	aead	dh	kem	encrypt	sign

List of subroutines:	verify	decode	encode	sort	core	hashblocks	scalarmult

Measurements of public-key Diffie–Hellman secret-sharing systems, indexed by machine

eBATS (ECRYPT Benchmarking of Asymmetric Systems) is a project to measure the performance of public-key systems. This page presents the benchmark results collected in eBATS for public-key Diffie–Hellman secret-sharing systems:

Time (cycles) to generate a key pair: a secret key and a corresponding public key.
Time to compute a shared secret, given one user's secret key and another user's public key.
Space (bytes) for a secret key.
Space for a public key.
Space for a shared secret.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation.

Each computer name is linked to additional information about the implementations and compilers selected for benchmarking.

There is a separate page with more information about each Diffie–Hellman system and each implementation. Designers and implementors interested in submitting new Diffie–Hellman systems and new implementations of existing systems should read the call for submissions.

Sizes across machines

Secret key
bytes	system
20	sclaus1024
28	sclaus2048
28	surf2113
29	hector
32	curve2251
32	curve25519
32	ecfp256e
32	ecfp256h
32	ecfp256i
32	ecfp256q
32	ecfp256s
32	gls1271
32	gls254
32	gls254prot
32	hecfp127i
32	hecfp128bk
32	hecfp128fkt
32	hecfp128i
32	jacfp127i
32	jacfp128bk
32	k298
32	kumfp127g
32	kumfp128g
32	kumjacfp127g
32	kummer
32	nistp256
32	prjfp127i
32	prjfp128bk
32	surf127eps
48	k277mon
48	k277taa
104	nist521gs
130	ed521gs
144	ed448goldilocks
256	claus

Public key
bytes	system
32	curve2251
32	curve25519
32	gls1271
48	kumfp127g
48	kumfp128g
48	kumjacfp127g
48	kummer
48	surf127eps
48	surf2113
56	ed448goldilocks
60	hector
64	ecfp256e
64	ecfp256h
64	ecfp256q
64	ecfp256s
64	gls254
64	gls254prot
64	hecfp127i
64	hecfp128bk
64	hecfp128fkt
64	hecfp128i
64	jacfp127i
64	jacfp128bk
64	nistp256
64	prjfp127i
64	prjfp128bk
80	k277mon
80	k277taa
96	ecfp256i
96	k298
128	claus
128	sclaus1024
144	ed521gs
144	nist521gs
256	sclaus2048

Shared secret
bytes	system
32	curve2251
32	curve25519
32	ecfp256e
32	ecfp256h
32	ecfp256i
32	ecfp256q
32	ecfp256s
32	gls1271
32	gls254prot
32..32..64	gls254
40	k277mon
40	k277taa
48	k298
48	kumfp127g
48	kumfp128g
48	kumjacfp127g
48	kummer
48	surf127eps
48	surf2113
60	hector
64	ed448goldilocks
64	hecfp127i
64	hecfp128bk
64	hecfp128fkt
64	hecfp128i
64	jacfp127i
64	jacfp128bk
64	nistp256
64	prjfp127i
64	prjfp128bk
72	ed521gs
72	nist521gs
128	claus
128	sclaus1024
256	sclaus2048

aarch64; Firestorm (610f0230); 2020 Apple M1; 4 x 3200MHz; unstable; `minimac`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
103596?	106662?	191459?	T: kummer
106662?	107063?	196792?	T: curve25519
159594?	159860?	261590?	T: nistp256
489848?	492114?	801969?	T: ed521gs
667441?	668907?	980761?	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
103063?	103996?	168927?	T: kummer
106662?	107062?	174526?	T: curve25519
424383?	424783?	622109?	T: nistp256
489847?	490248?	656374?	T: ed521gs
666774	667574	780236	T: nist521gs

amd64; TigerLake (806c1); 2020 Intel Core i7-1165G7; 4 x 2800MHz; unstable; `pascalinspiron75062n1`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
34713	35424	35982	T: gls254
44020?	44122?	62494?	T: k277taa
40251?	48857?	52389?	T: curve2251
40731?	55280?	55846?	T: gls254prot
48486?	59179?	66204?	T: kummer
66531?	66652?	90521?	T: k277mon
68058	68503	70155	T: k298
85612?	143849?	148600?	T: gls1271
121691?	167095?	168975?	T: curve25519
201555?	202390?	349382?	T: ed448goldilocks
413114?	682870?	684613?	T: nistp256
817128?	820394?	1420902?	T: ed521gs
1057456	1080821	1081832	T: claus
966532?	1605510?	1671940?	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
33932	34009	34088	T: gls254
43953?	44086?	62441?	T: k277taa
40617?	55032?	55657?	T: gls254prot
48345?	58817?	66103?	T: kummer
66462?	66666?	90539?	T: k277mon
67516	68008	69718	T: k298
142970?	165794?	180848?	T: curve2251
130971?	181117?	181710?	T: curve25519
193504?	325432?	352758?	T: gls1271
618730?	621789?	1130834?	T: ed448goldilocks
824258?	827097?	1419341?	T: ed521gs
1050336	1052075	1074540	T: claus
909142?	1420240?	1423559?	T: nistp256
975478?	1596616?	1671468?	T: nist521gs

amd64; IceLake (706e5); 2020 Intel Core i5-1030NG7; 4 x 1100MHz; `icelake`, `supercop-20200826`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
33522	33731	34144	T: gls254
35610	35688	35857	T: gls254prot
42674	42790	43079	T: k277taa
49133	49284	49590	T: kummer
48964	49406	49890	T: k298
64155	64226	64474	T: k277mon
139430	139922	140420	T: ed448goldilocks
146164	146617	147668	T: curve25519
177831	179075	180402	T: surf127eps
216697	219367	222743	T: sclaus1024
236243	238668	241547	T: nistp256
415881	418845	426337	T: surf2113
600080	607273	614920	T: curve2251
803594	809836	813477	T: ed521gs
989223	994163	999637	T: nist521gs
1118410	1128046	1156630	T: sclaus2048
1302784	1309263	1319571	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
32803	33007	33439	T: gls254
35509	35604	35832	T: gls254prot
42560	42769	43190	T: k277taa
49070	49244	49472	T: kummer
48887	49310	49909	T: k298
64094	64243	64566	T: k277mon
146537	147229	148198	T: curve25519
171622	173237	174793	T: surf127eps
217221	219534	222323	T: sclaus1024
412044	414424	419682	T: surf2113
465488	467029	469786	T: ed448goldilocks
592171	597431	608049	T: curve2251
595051	598639	602985	T: nistp256
802592	807016	811640	T: ed521gs
996844	1002068	1067900	T: nist521gs
1114489	1125403	1153790	T: sclaus2048
1302809	1307768	1315341	T: claus

aarch64; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; `pi4b`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
249194	249428	249460	T: kummer
356584	356693	356731	T: curve25519
370218	373875	374104	T: nistp256
422489	424229	425813	T: surf127eps
598136	603984	610508	T: sclaus1024
1946286	1952532	1982985	T: ed521gs
2399036	2402882	2426406	T: nist521gs
3001518	3020336	3049292	T: sclaus2048
3607455	3621294	3638001	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
248094	248361	249344	T: kummer
351136	355994	356528	T: curve25519
404320	409302	411478	T: surf127eps
600398	607993	609286	T: sclaus1024
1306205	1306956	1308208	T: nistp256
1945258	1949023	1978577	T: ed521gs
2403187	2404408	2428206	T: nist521gs
3006789	3049635	3065381	T: sclaus2048
3598796	3620430	3629059	T: claus

aarch64; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; `rpi4ubuntu64`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
239466	239647	240371	kummer
336971	336976	337244	curve25519
365080	365152	365478	nistp256
438473	440226	441757	surf127eps
623249	629417	636188	sclaus1024
1958396	1966893	1986867	ed521gs
2447697	2452213	2478604	nist521gs
3105178	3136080	3157810	sclaus2048
3774947	3788723	3804249	claus

Cycles to compute a shared secret
25%	50%	75%	system
240323	240383	240823	kummer
336698	336701	337594	curve25519
427913	429158	430428	surf127eps
627260	628143	628643	sclaus1024
1272536	1274201	1282354	nistp256
1957107	1960450	1983950	ed521gs
2446502	2448834	2462133	nist521gs
3132359	3142968	3167355	sclaus2048
3762686	3786122	3798556	claus

armeabi; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; `rpi4`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
221469	225301	238663	kummer
304884	304912	309941	curve25519
520659	535659	562019	nistp256
1910973	2079444	2236718	sclaus1024
9099538	9992386	10477298	sclaus2048
11052372	11097120	11820000	claus

Cycles to compute a shared secret
25%	50%	75%	system
221330	226218	239802	kummer
304773	304775	307828	curve25519
1785307	1835502	2022499	nistp256
1939223	2089026	2197524	sclaus1024
9181731	9646281	10484381	sclaus2048
11081400	11121761	12596599	claus

ppc64; POWER9 (004e1203); 2019? IBM 02CY642; 22 x 3800MHz; `power9`, `supercop-20210326`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
153845	153989	154567	T: curve25519
219096	221593	236369	T: sclaus1024
233761	234189	239890	T: kummer
324530	324909	325258	T: nistp256
380449	381816	383291	T: surf127eps
939493	947857	967568	T: sclaus2048
990417	991668	1005008	T: ed521gs
1260583	1261379	1293254	T: nist521gs
1300860	1350527	1401659	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
153687	153861	157772	T: curve25519
224841	226275	237648	T: sclaus1024
233518	235179	243935	T: kummer
368934	370377	372535	T: surf127eps
876979	877598	878065	T: nistp256
949847	953575	968856	T: sclaus2048
989193	989902	1006598	T: ed521gs
1260082	1260694	1262851	T: nist521gs
1301062	1351044	1401612	T: claus

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; `colossus6`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
20205?	23107?	26212?	T: hecfp127i
24525	27045	30307	T: jacfp128bk
22860?	28553?	31410?	T: jacfp127i
27945	29745	33840	T: curve2251
27405	29925	32895	T: ecfp256e
30082	30375	30735	T: gls254
30397	30420	30442	T: gls254prot
27630	30555	32895	T: kumjacfp127g
24615?	30713?	34020?	T: prjfp127i
30127?	31342?	39713?	T: hecfp128fkt
29273	31523	34493	T: hecfp128bk
31275?	33907?	39262?	T: ecfp256s
30915?	35123?	42075?	T: ecfp256h
32760	36292	39758	T: hecfp128i
36968	37012	37057	T: k277taa
31433?	37372?	40410?	T: prjfp128bk
34650?	39105?	45608?	T: ecfp256q
38880	39172	39195	T: kummer
42863	43583	44370	T: gls1271
43942	44528	46395	T: k298
57690	57690	57758	T: kumfp127g
58860	58860	59310	T: k277mon
75713	75758	75870	T: kumfp128g
93780	94297	94635	T: curve25519
100058	100620	101542	T: surf127eps
109597	109958	113400	T: ed448goldilocks
109597	110385	111330	T: ecfp256i
114255	116370	123750	T: sclaus1024
148297	153675	161032	T: hector
164115	165510	170685	T: nistp256
367988	369720	372420	T: surf2113
550237	551745	556538	T: ed521gs
585697	590580	596588	T: sclaus2048
652050	652522	658372	T: nist521gs
678690	682830	689355	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
28710	28755	28868	T: gls254
30330	30330	30330	T: gls254prot
36653	36923	37215	T: k277taa
38902	39150	39172	T: kummer
43785	43807	43830	T: k298
58657	58658	59107	T: kumfp127g
58770	58815	59625	T: jacfp128bk
58815	58815	59265	T: k277mon
59153	59288	59940	T: kumjacfp127g
69570	69615	70178	T: prjfp128bk
71167	71348	71730	T: hecfp128bk
73643	73733	73935	T: hecfp128fkt
79672	79673	80167	T: kumfp128g
90000	90315	91013	T: jacfp127i
93780	94342	94590	T: curve25519
97110	97312	97920	T: surf127eps
101160	101183	101812	T: ecfp256e
104310	105300	108112	T: gls1271
106493	106830	107325	T: ecfp256i
107775	107933	108720	T: curve2251
110677	110767	111555	T: ecfp256q
110723	110835	112095	T: prjfp127i
112995	113062	113490	T: hecfp127i
115808	116303	117382	T: sclaus1024
124605	124740	125662	T: ecfp256h
147622	147735	148725	T: ecfp256s
156398	156555	156623	T: hecfp128i
336465	337275	339795	T: ed448goldilocks
369292	369788	372442	T: surf2113
402075	402817	405608	T: nistp256
512842	515498	525915	T: hector
548887	549562	551115	T: ed521gs
583065	586597	590220	T: sclaus2048
647505	648517	649778	T: nist521gs
677453	679455	685845	T: claus

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; `colossus7`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
25695	26460	27630	T: jacfp127i
25492	26752	28305	T: prjfp127i
29430	30352	33142	T: curve2251
29610	31410	33030	T: jacfp128bk
29970	31725	32625	T: hecfp127i
31972	32288	32422	T: gls254
32423	33053	33120	T: gls254prot
32625	33480	35843	T: hecfp128i
32895	34380	36518	T: prjfp128bk
38115	39128	40702	T: hecfp128bk
39218	39577	40163	T: k277taa
39060	40297	41377	T: hecfp128fkt
44573	45428	46328	T: kummer
47002	47632	48330	T: k298
61065	62550	63158	T: k277mon
58095	67612	72022	T: gls1271
92835	95895	106673	T: kumfp128g
109283	117697	130838	T: curve25519
126540	134618	154553	T: ed448goldilocks
192578	203738	224820	T: nistp256
594360	606397	680602	T: ed521gs
708638	719528	745133	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
30420	30757	30803	T: gls254
31905	32625	32647	T: gls254prot
38610	38745	39150	T: k277taa
43897	43965	44325	T: kummer
46102	46373	46553	T: k298
61515	63000	63090	T: k277mon
83700	84578	90068	T: kumfp128g
85973	86963	94500	T: jacfp128bk
98145	102015	116797	T: hecfp128bk
101273	102038	102420	T: curve25519
98325	108068	112207	T: prjfp128bk
105705	110677	118170	T: hecfp128fkt
113985	115042	115065	T: curve2251
112500	117653	124200	T: gls1271
118080	125663	131355	T: jacfp127i
135113	143505	162900	T: hecfp127i
176332	182205	193028	T: prjfp127i
178830	184050	193612	T: hecfp128i
362632	365220	372420	T: ed448goldilocks
438840	441315	444060	T: nistp256
581535	595035	604237	T: ed521gs
701910	711248	719055	T: nist521gs

amd64; Zen (810f81); 2019 AMD Ryzen Embedded R1606G; 2 x 2600MHz; unstable; `ghf51`, `supercop-20200702`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
55198	57382	64194	curve2251
62218	64870	69030	ecfp256s
60632?	66118?	81640?	ecfp256h
62764?	67340?	85644?	ecfp256e
64870	72670	74828	gls254prot
68068	73242	75790	gls254
84448	87074	99268	k277taa
96330	97578	112996	k298
73034?	98332?	103012?	ecfp256q
135668	136552	168402	k277mon
118820?	156208?	161486?	gls1271
165672	166062	166478	kummer
221286	223366	275522	curve25519
262730	263666	264654	surf127eps
270348	274326	283764	sclaus1024
283322	285506	289744	ecfp256i
346164?	417794?	467220?	hector
368732?	444548?	519636?	ed448goldilocks
560534	664456	676182	nistp256
772928?	909246?	1042834?	surf2113
1589042	1593852	1617720	ed521gs
1587716?	1595906?	2398032?	claus
1698346	1751880	1883336	nist521gs
1538082?	2000830?	2065440?	sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
65260	69368	73658	gls254
62764	72514	74438	gls254prot
86190	86450	98748	k277taa
95992	96356	112970	k298
135564	135668	168168	k277mon
165464	165646	165880	kummer
197990	198276	227760	curve2251
237770	238056	297128	curve25519
255996	256568	257452	surf127eps
264394?	266474?	385788?	ecfp256e
269464?	273130?	390780?	sclaus1024
280566	281164	283790	ecfp256i
307424?	308282?	442936?	ecfp256h
322348	323102	333762	ecfp256s
261222?	379886?	386984?	ecfp256q
292604?	390104?	396344?	gls1271
767520?	891488?	1048424?	surf2113
1147588?	1338168?	1571414?	hector
917800?	1339182?	1358734?	ed448goldilocks
1353612	1527812	1551212	nistp256
1537380	1589770	1591850	ed521gs
1587872?	1590524?	2397434?	claus
1697410	1705288	1974752	nist521gs
1382004?	2020798?	2054494?	sclaus2048

amd64; CometLake (806ec); 2019 Intel Core i3-10110U; 2 x 2100MHz; `comet`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
20961	21454	22270	T: kumjacfp127g
21572	22576	23315	T: jacfp127i
25261	26053	26949	T: prjfp127i
25996	26854	27832	T: hecfp127i
30267	31328	32259	T: jacfp128bk
35808	36454	37276	T: prjfp128bk
37201	37471	37858	T: gls254
36964	37929	39196	T: hecfp128i
37548	38244	39122	T: hecfp128fkt
37744	38410	39173	T: hecfp128bk
38269	38836	39693	T: curve2251
39061	39098	39147	T: gls254prot
45139	45656	46463	T: ecfp256e
45886	46293	46331	T: k277taa
46023	46898	48889	T: ecfp256h
49317	49825	50475	T: ecfp256s
51387	51941	52956	T: ecfp256q
53340	53403	53487	T: kummer
54086	54195	54408	T: k298
69921	70762	71611	T: gls1271
70365	71721	72298	T: k277mon
79226	79395	80104	T: kumfp127g
112736	112804	112916	T: kumfp128g
126478	126705	126951	T: curve25519
153511	153752	153969	T: ed448goldilocks
177698	179528	181105	T: sclaus1024
184190	187033	187854	T: surf127eps
192971	196204	203161	T: ecfp256i
235513	236319	237024	T: nistp256
257327	264420	276371	T: hector
504448	506315	507508	T: surf2113
816517	817163	818623	T: ed521gs
912497	922458	965766	T: sclaus2048
978281	979937	982372	T: nist521gs
981241	983435	988884	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
36139	36198	36292	T: gls254
38866	38905	38970	T: gls254prot
45686	46070	46105	T: k277taa
53214	53286	53350	T: kummer
53331	53422	53526	T: k298
71615	71720	72960	T: k277mon
81649	82198	82607	T: kumfp127g
82941	83819	83961	T: kumjacfp127g
89129	89199	89325	T: jacfp128bk
108668	109210	110174	T: prjfp128bk
114237	114522	114879	T: hecfp128bk
117916	118031	118231	T: hecfp128fkt
118063	118162	118348	T: kumfp128g
124483	125615	125928	T: jacfp127i
136171	136590	137443	T: curve25519
143766	144005	144139	T: curve2251
166194	166810	167329	T: prjfp127i
167692	168961	169421	T: hecfp127i
172057	174412	176158	T: gls1271
175382	179286	179682	T: sclaus1024
179396	179749	180622	T: ecfp256e
179904	182356	183419	T: surf127eps
188871	189145	189754	T: ecfp256i
189274	189591	190288	T: ecfp256q
222509	222824	223451	T: ecfp256h
241566	242083	242672	T: ecfp256s
254453	255188	255860	T: hecfp128i
458517	458832	459161	T: ed448goldilocks
504878	505329	505736	T: surf2113
584151	585057	587562	T: nistp256
817024	822628	837240	T: ed521gs
873090	878162	884112	T: hector
930086	953186	968792	T: sclaus2048
975599	978328	981745	T: claus
978963	980355	982574	T: nist521gs

amd64; CascadeLake (50657); 2019 Intel Xeon Gold 6230; 40 x 2100MHz; unstable; `cel02`, `supercop-20201130`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
32706	33234	34614	T: kumjacfp127g
34626	36210	37558	T: jacfp127i
41590	43194	45956	T: prjfp127i
44246	46096	48166	T: hecfp127i
50694	52028	54010	T: jacfp128bk
52368	53050	58760	T: curve2251
56344	57624	58716	T: prjfp128bk
56102	57844	59168	T: hecfp128bk
56550	57850	59190	T: hecfp128fkt
57908	59134	60432	T: hecfp128i
61352	62204	65598	T: gls254
63160	63326	67712	T: gls254prot
67254	69026	70854	T: ecfp256e
67258	70098	74296	T: ecfp256s
67748	71136	73004	T: ecfp256h
74484	74580	74672	T: k277taa
73186	75078	81258	T: ecfp256q
76650	80986	83830	T: k298
81292	86034	87222	T: kummer
90616	95962	96848	T: k277mon
131428	132014	138058	T: kumfp127g
180704	187438	190238	T: curve25519
207584	207848	222432	T: kumfp128g
291054	293440	293864	T: ed448goldilocks
289238	299022	307752	T: ecfp256i
311962	315190	320638	T: surf127eps
336350	341930	345948	T: sclaus1024
539896	549466	557090	T: nistp256
948680	1004152	1009544	T: surf2113
1613022	1636248	1654726	T: sclaus2048
1763428	1802116	2137402	T: nist521gs
1805136	1875428	2031300	T: claus
2692014	2887980	2900652	T: ed521gs

Cycles to compute a shared secret
25%	50%	75%	system
59138	59976	63690	T: gls254
63046	63206	67656	T: gls254prot
74342	74444	74512	T: k277taa
76082	81032	83466	T: k298
81148	85906	87150	T: kummer
90686	95684	96706	T: k277mon
133636	134070	140032	T: kumfp127g
137676	138248	140764	T: kumjacfp127g
138810	148094	156238	T: jacfp128bk
167780	172656	179216	T: hecfp128bk
170598	178212	180194	T: prjfp128bk
180762	189168	191758	T: hecfp128fkt
184830	192414	192694	T: curve2251
190144	200382	200944	T: curve25519
199346	204780	209558	T: jacfp127i
213424	213694	227676	T: kumfp128g
252548	257326	262096	T: hecfp127i
266828	286710	287234	T: prjfp127i
277024	292936	298704	T: ecfp256q
294152	295808	303758	T: ecfp256i
277480	298268	301952	T: ecfp256e
304446	306020	311120	T: surf127eps
326546	333844	354906	T: ecfp256h
323260	346148	349038	T: sclaus1024
339934	352680	376502	T: ecfp256s
402470	416534	417002	T: hecfp128i
794500	795626	796456	T: ed448goldilocks
993414	995938	1007624	T: surf2113
1099488	1151012	1186786	T: nistp256
1507836	1622894	1693056	T: sclaus2048
1794748	1821518	2022596	T: claus
1788816	2013584	2136836	T: nist521gs
2647034	2869572	2897724	T: ed521gs

amd64; CascadeLake (50657); 2019 Intel Xeon Gold 6230; 40 x 2100MHz; unstable; `ygritte`, `supercop-20200525`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
33196	33456	35894	curve2251
32644	33492	35764	ecfp256e
33744	34028	34474	gls254
34950	35196	35242	gls254prot
34424	35672	40194	ecfp256h
34656	35770	39914	ecfp256s
39314	39762	40740	ecfp256q
39878	39908	39936	k277taa
42210	42252	42290	kummer
44546	44898	45016	k298
51498	59086	60134	gls1271
65056	65178	65276	k277mon
95368	110952	111360	curve25519
124994	125170	125346	ed448goldilocks
144032	144800	145702	ecfp256i
171452	173320	175690	sclaus1024
189442	189678	220900	nistp256
628976	629852	748226	ed521gs
732966	733994	833836	nist521gs
865882	873972	882340	sclaus2048
989802	1007004	1064002	claus

Cycles to compute a shared secret
25%	50%	75%	system
28034	28058	28084	gls254
29884	30106	30138	gls254prot
33714	39812	39854	k277taa
42154	42192	42234	kummer
43758	44198	44272	k298
55742	55838	55922	k277mon
102294	102492	102590	curve25519
107120	107810	107978	curve2251
125914	128668	134702	gls1271
133034	133158	133306	ecfp256e
140556	140658	140804	ecfp256i
142702	142828	143030	ecfp256q
165604	165730	165924	ecfp256h
179622	179948	180112	ecfp256s
181984	182838	183812	sclaus1024
351960	352238	352584	ed448goldilocks
449076	449244	449504	nistp256
628674	629186	629502	ed521gs
732486	732888	735224	nist521gs
867200	877534	884402	sclaus2048
986034	989768	993964	claus

amd64; CascadeLake (50657); 2019 Intel Core i9-10980XE; 18 x 3000MHz; `avx512imath`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
22942	23920	25532	T: jacfp127i
24521	25508	26466	T: kumjacfp127g
30537	32391	34632	T: prjfp127i
31488	33166	35239	T: hecfp127i
33309	34366	35420	T: jacfp128bk
35112	35712	37647	T: prjfp128bk
38459	38763	41612	T: curve2251
38696	39119	39493	T: gls254
40378	40410	40446	T: gls254prot
41277	43173	46538	T: hecfp128bk
41880	43460	46879	T: hecfp128fkt
43162	44302	47228	T: ecfp256e
43205	44922	46417	T: hecfp128i
45616	46857	50701	T: ecfp256h
47040	48039	51942	T: ecfp256s
48533	48578	48625	T: kummer
50011	50042	50100	T: k277taa
50836	51368	52401	T: ecfp256q
69976	71077	72303	T: gls1271
74181	74401	74479	T: k277mon
79992	80102	80227	T: kumfp127g
113033	113138	113281	T: kumfp128g
126053	127104	127295	T: curve25519
180867	181318	181751	T: ed448goldilocks
192604	193530	195076	T: ecfp256i
230062	232318	234278	T: sclaus1024
274593	274830	286603	T: nistp256
815460	816320	817222	T: ed521gs
945603	946034	946657	T: nist521gs
976164	976586	977059	T: claus
1149504	1158740	1167421	T: sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
37542	37566	37600	T: gls254
40277	40303	40335	T: gls254prot
48451	48495	48544	T: kummer
49946	49981	50031	T: k277taa
74104	74343	74414	T: k277mon
82293	82388	82513	T: kumfp127g
83670	83756	83833	T: kumjacfp127g
89241	89321	89393	T: jacfp128bk
109675	109801	109973	T: prjfp128bk
117523	117687	117840	T: hecfp128bk
118274	118346	118798	T: kumfp128g
120759	120853	120965	T: hecfp128fkt
125607	125699	125818	T: jacfp127i
136236	136787	137606	T: curve25519
142402	144055	144380	T: curve2251
166911	167038	167186	T: prjfp127i
170436	170638	174190	T: hecfp127i
171219	173467	179102	T: gls1271
177659	177835	178025	T: ecfp256e
187333	187569	187788	T: ecfp256q
188174	188325	188525	T: ecfp256i
221385	221564	221721	T: ecfp256h
241705	241876	242093	T: ecfp256s
244691	246341	249729	T: sclaus1024
258262	258759	259196	T: hecfp128i
509021	509336	509626	T: ed448goldilocks
686877	687235	687513	T: nistp256
815272	815800	816798	T: ed521gs
945263	945700	946329	T: nist521gs
970505	970866	971374	T: claus
1175498	1186144	1192945	T: sclaus2048

aarch64; Skylark (503f0002); 2018 Ampere eMAG 8180; 32 x 3300MHz; `gcc185`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
278025	278685	280005	T: curve25519
355245	355245	355410	T: kummer
379170	380985	384780	T: surf127eps
461010	465630	471405	T: sclaus1024
495495	495660	496320	T: nistp256
1711380	1712700	1717980	T: ed521gs
2089065	2089230	2091045	T: nist521gs
2227335	2253405	2293830	T: sclaus2048
2725965	2732730	2738670	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
278025	278850	280005	T: curve25519
355245	355245	355245	T: kummer
377025	378675	381480	T: surf127eps
459855	466620	476850	T: sclaus1024
1108305	1109130	1109625	T: nistp256
1711545	1712370	1713360	T: ed521gs
2088735	2089560	2090385	T: nist521gs
2260335	2265780	2294160	T: sclaus2048
2723490	2727615	2729925	T: claus

aarch64; A53+crypto (410fd034); 2018 NXP i.MX 8M; 4 x 1500MHz; `googlecoraldev`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
421380	421560	421740	kummer
469440	469440	469620	curve25519
471960	472320	472680	nistp256
604980	606960	608040	surf127eps
1051920	1063800	1074060	sclaus1024
3101400	3111120	3116520	ed521gs
3555000	3566160	3570480	nist521gs
5175360	5215320	5254380	sclaus2048
6363900	6377220	6392160	claus

Cycles to compute a shared secret
25%	50%	75%	system
421380	421380	421560	kummer
475740	475740	475920	curve25519
602820	606600	606960	surf127eps
1059300	1060560	1076400	sclaus1024
1589940	1589940	1600020	nistp256
3102480	3111480	3117060	ed521gs
3553200	3564000	3568680	nist521gs
5189580	5208120	5231520	sclaus2048
6368040	6382800	6387660	claus

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; `pi3aplus`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
429408	432827	438483	T: kummer
472635	475025	477602	T: curve25519
475426	478193	479739	T: nistp256
609763	612358	615115	T: surf127eps
1001567	1013207	1051694	T: sclaus1024
3144612	3175798	3212044	T: ed521gs
3647581	3693354	3729645	T: nist521gs
4989418	5051910	5104648	T: sclaus2048
5569458	5672968	5710278	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
429960	432230	434707	T: kummer
478853	481330	484060	T: curve25519
611284	612048	614561	T: surf127eps
1011603	1016503	1035532	T: sclaus1024
1602333	1612600	1651944	T: nistp256
3141331	3176367	3212476	T: ed521gs
3616847	3643352	3687864	T: nist521gs
4993987	5049655	5129100	T: sclaus2048
5427106	5498398	5617882	T: claus

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; `pi3bplus`, `supercop-20210604`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
421690	422033	422861	T: kummer
472614	474796	505959	T: nistp256
504641	509274	527868	T: curve25519
635917	638790	645312	T: surf127eps
1034237	1044237	1052519	T: sclaus1024
3101818	3126330	3339774	T: ed521gs
3621448	3836180	3908128	T: nist521gs
5102961	5146953	5173387	T: sclaus2048
5360477	5449700	5471666	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
421577	421869	422302	T: kummer
503856	504454	528443	T: curve25519
631638	635860	640814	T: surf127eps
1038487	1062196	1069787	T: sclaus1024
1596444	1604779	1697174	T: nistp256
3099062	3121488	3341374	T: ed521gs
3615688	3755807	3883894	T: nist521gs
5098992	5125845	5154634	T: sclaus2048
5334733	5412856	5429611	T: claus

amd64; Zen (810f10); 2018 AMD Ryzen 5 2400G; 4 x 3600MHz; unstable; `gcc67`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
26100	28887	30179	T: jacfp127i
27798	29148	31092	T: prjfp127i
28176	29450	30679	T: kumjacfp127g
31042	33271	34776	T: hecfp127i
35417	38204	39641	T: jacfp128bk
38816	39290	39867	T: prjfp128bk
38636	39626	41575	T: ecfp256e
39229	40837	42683	T: hecfp128bk
40174	40878	41505	T: hecfp128fkt
41275	41674	43237	T: curve2251
41120	43241	44824	T: hecfp128i
41835	43622	46974	T: ecfp256h
44795	45128	45436	T: gls254
43529	45452	48952	T: ecfp256s
45971	46031	46102	T: gls254prot
45924	46771	49560	T: ecfp256q
56790	56836	57064	T: k277taa
66249	66755	67447	T: gls1271
74196	74339	74542	T: k298
90249	90287	91185	T: k277mon
93088	95119	95502	T: kummer
101568	101636	101729	T: kumfp127g
133240	133311	133411	T: kumfp128g
143961	144006	144021	T: curve25519
183938	184827	186105	T: ecfp256i
189608	190564	193164	T: surf127eps
201021	203066	204964	T: sclaus1024
210045	210207	210545	T: ed448goldilocks
369991	370321	370625	T: nistp256
513214	515401	524601	T: surf2113
971495	972254	973966	T: ed521gs
996317	1004779	1015192	T: sclaus2048
1191690	1194896	1198080	T: claus
1197072	1198680	1200438	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
43843	43888	43905	T: gls254
45912	45973	46030	T: gls254prot
56606	56708	56743	T: k277taa
74122	74233	74354	T: k298
87582	90181	90219	T: k277mon
93049	95106	95464	T: kummer
104235	104338	104366	T: kumfp127g
104572	104619	104740	T: jacfp128bk
106352	106428	106486	T: kumjacfp127g
126596	126715	126881	T: prjfp128bk
129908	130080	130174	T: hecfp128bk
134371	134529	134739	T: hecfp128fkt
139257	139309	140127	T: kumfp128g
156686	156933	158458	T: curve25519
160599	161303	169512	T: gls1271
162311	162476	163170	T: jacfp127i
162533	163305	163972	T: curve2251
174075	174244	174585	T: ecfp256e
182367	182586	183086	T: ecfp256i
183685	183800	183967	T: ecfp256q
183883	184106	188444	T: surf127eps
203613	203710	204185	T: prjfp127i
195600	204265	206569	T: sclaus1024
207468	207758	208062	T: hecfp127i
215646	215720	215883	T: ecfp256h
235825	236173	236390	T: ecfp256s
285708	285886	286139	T: hecfp128i
507678	514240	515933	T: surf2113
641513	643332	645617	T: ed448goldilocks
676527	677324	677905	T: nistp256
969593	970968	972690	T: ed521gs
990477	996065	998992	T: sclaus2048
1196328	1197132	1199707	T: nist521gs
1193789	1197872	1199786	T: claus

amd64; Zen+ (800f82); 2018 AMD Ryzen 7 2700; 8 x 3200MHz; unstable; `gcc68`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
31872	32896	35520	ecfp256e
32992	33728	36544	curve2251
35008	35168	35296	gls254
35520	35712	35712	gls254prot
34880	36832	41600	ecfp256h
36000	37728	42688	ecfp256s
37440	39168	43840	ecfp256q
44448	44480	44576	k277taa
52224	52352	52800	k298
67840	69984	71744	k277mon
80224	80320	80384	kummer
115648	115680	116384	curve25519
147616	148256	149312	ecfp256i
149856	150496	151104	surf127eps
157568	157856	158080	ed448goldilocks
185440	187744	189696	sclaus1024
213056	214112	214336	nistp256
413504	415008	416640	surf2113
714848	717024	720384	ed521gs
877888	880032	884864	nist521gs
945472	952704	963680	sclaus2048
1109344	1113312	1120864	claus

Cycles to compute a shared secret
25%	50%	75%	system
33760	33984	34176	gls254
35424	35456	35648	gls254prot
44480	44544	44608	k277taa
51584	51712	51904	k298
67808	69536	70144	k277mon
80192	80288	80384	kummer
125824	126016	127264	curve25519
130368	130816	131200	curve2251
138272	138432	139072	ecfp256e
145088	145856	145952	ecfp256i
146560	147136	147552	ecfp256q
147040	147296	148000	surf127eps
171840	172096	173088	ecfp256h
186816	186944	188064	ecfp256s
186656	189152	190432	sclaus1024
412576	414656	414848	surf2113
471552	473184	475744	ed448goldilocks
526400	529216	530304	nistp256
715776	717632	719296	ed521gs
878752	880128	882240	nist521gs
948160	951776	957856	sclaus2048
1113536	1115744	1116608	claus

amd64; CoffeeLake (906ea); 2018 Intel Xeon E-2124; 4 x 3300MHz; `r24000`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
21661	22711	23683	T: jacfp127i
22493	23179	24734	T: kumjacfp127g
25225	26008	27501	T: prjfp127i
25767	26899	28107	T: hecfp127i
30130	31341	32445	T: jacfp128bk
35691	36702	37765	T: prjfp128bk
36779	36999	37458	T: gls254
37485	38423	39577	T: hecfp128bk
37625	38583	39492	T: hecfp128fkt
38481	38730	39277	T: curve2251
37840	38761	39696	T: hecfp128i
38842	38886	38941	T: gls254prot
42613	43294	44479	T: ecfp256e
45068	45628	47622	T: ecfp256h
45871	45924	46013	T: k277taa
46431	47099	48527	T: ecfp256s
48210	49058	50823	T: ecfp256q
52114	52336	52435	T: k298
52999	53469	54166	T: kummer
68871	69742	70607	T: gls1271
71305	71341	71381	T: k277mon
79029	79175	79301	T: kumfp127g
110414	110463	110525	T: kumfp128g
125164	125303	125539	T: curve25519
153365	153650	153924	T: ed448goldilocks
175276	177093	178576	T: sclaus1024
182804	183483	183936	T: surf127eps
190141	190965	192103	T: ecfp256i
245414	245637	245857	T: nistp256
505054	507069	508382	T: surf2113
807735	808041	808412	T: ed521gs
886258	892693	899201	T: sclaus2048
935142	935388	935732	T: nist521gs
968823	969306	969730	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
35762	35792	35829	T: gls254
38568	38614	38652	T: gls254prot
45636	45671	45779	T: k277taa
51833	51908	51977	T: k298
52916	53166	53422	T: kummer
71218	71251	71288	T: k277mon
81334	81448	81568	T: kumfp127g
82825	82913	83004	T: kumjacfp127g
87511	87582	87656	T: jacfp128bk
108166	108289	108432	T: prjfp128bk
112033	112208	112347	T: hecfp128bk
115562	115609	115658	T: kumfp128g
116042	116239	116428	T: hecfp128fkt
124253	124340	124500	T: jacfp127i
135014	135390	135608	T: curve25519
144596	144704	144868	T: curve2251
165179	165324	165553	T: prjfp127i
167127	167242	167386	T: hecfp127i
175293	175416	175559	T: ecfp256e
173439	177271	177717	T: gls1271
174619	178909	182563	T: sclaus1024
179295	179646	179986	T: surf127eps
185319	185469	185640	T: ecfp256q
185598	185734	185867	T: ecfp256i
217913	218109	218299	T: ecfp256h
239745	239931	240098	T: ecfp256s
247956	248140	248319	T: hecfp128i
454987	455224	455421	T: ed448goldilocks
488007	498433	506233	T: surf2113
599149	599319	599533	T: nistp256
807181	807458	807712	T: ed521gs
895100	901153	901871	T: sclaus2048
934831	935010	935215	T: nist521gs
963006	963550	964877	T: claus

amd64; KabyLake (906e9); 2018 Intel Core i7-8705G; 4 x 3100MHz; unstable; `sectionthirtyone`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
50953	51554	52460	gls254
53160	53775	54869	gls254prot
55450	56993	59824	curve2251
67854	71500	75957	ecfp256s
68870	71904	75042	ecfp256h
72879	73206	73424	k277taa
75292	77801	81596	k298
76971	81984	87849	ecfp256q
85068	88359	92757	kummer
90586	92188	93834	ecfp256e
93531	98225	115477	k277mon
121099	131668	136697	gls1271
186299	187008	196024	curve25519
254473	259502	261922	ed448goldilocks
293337	307455	318499	ecfp256i
377621	383067	430616	sclaus1024
449527	452947	454188	nistp256
1614856	1639372	1679905	ed521gs
1946350	1988879	2071796	nist521gs
1941676	2187505	2239233	sclaus2048
2162239	2484185	2561349	claus

Cycles to compute a shared secret
25%	50%	75%	system
49911	50739	51262	gls254
52692	53707	54602	gls254prot
72955	73226	73848	k277taa
73895	75515	78260	k298
83263	85753	90818	kummer
91544	95990	98121	k277mon
187648	190433	190930	curve2251
197705	197950	211429	curve25519
285497	286767	295324	ecfp256e
286472	295940	314899	ecfp256i
297293	304272	315627	ecfp256q
285487	327601	330490	gls1271
334733	346458	352742	ecfp256h
352142	367525	384938	ecfp256s
400397	406529	463949	sclaus1024
772752	773666	777993	ed448goldilocks
1069455	1071582	1078778	nistp256
1594202	1609994	1660468	ed521gs
1970360	2039350	2339236	nist521gs
1964730	2223170	2341124	sclaus2048
2197926	2465434	2537547	claus

aarch64; A53+crypto (410fd034); 2017 Rockchip RK3328; 4 x 1512MHz; `renegaderocrk3328cc`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
421398	421617	422384	kummer
469399	469437	469823	curve25519
471830	472479	474785	nistp256
605444	608019	612606	surf127eps
1058072	1070022	1084744	sclaus1024
3109202	3115057	3148417	ed521gs
3562458	3569585	3619386	nist521gs
5176773	5225800	5264318	sclaus2048
6383354	6399951	6417618	claus

Cycles to compute a shared secret
25%	50%	75%	system
421289	421312	421614	kummer
475752	475865	475950	curve25519
603770	606468	610654	surf127eps
1017672	1054055	1095758	sclaus1024
1589984	1590202	1598136	nistp256
3105212	3109521	3123445	ed521gs
3562535	3567026	3597895	nist521gs
5226572	5238922	5277198	sclaus2048
6391210	6398425	6407692	claus

aarch64; A53+crypto (410fd034); 2017 HiSilicon Kirin 970; 8 x 1844MHz; unstable; `hikey970`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
305439	307360	343859	kummer
347701	347701	349622	nistp256
389963	389963	437988	curve25519
472566	474487	476408	surf127eps
666587	672350	678113	sclaus1024
1855686	1857607	1861449	ed521gs
2291753	2295595	2310963	nist521gs
2956419	2977550	2998681	sclaus2048
4020653	4034100	4504745	claus

Cycles to compute a shared secret
25%	50%	75%	system
305439	307360	343859	kummer
393805	395726	443751	curve25519
461040	466803	468724	surf127eps
658903	672350	676192	sclaus1024
1194862	1196783	1342779	nistp256
1855686	1857607	1863370	ed521gs
2291753	2297516	2574140	nist521gs
2964103	3002523	3006365	sclaus2048
4036021	4041784	4520113	claus

riscv64; U54 (sifive,u54-mc); 2017 SiFive Freedom U540; 4 x 1400MHz; `hifiveunleashedriscv`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
993430	994087	1003898	curve25519
1088213	1088336	1095030	kummer
1275605	1277657	1285595	nistp256
4257500	4283823	4326742	sclaus1024
5591180	5597375	5607677	ed521gs
6748923	6749699	6751305	nist521gs
19985431	20123410	20267941	sclaus2048
25033713	25091678	25155771	claus

Cycles to compute a shared secret
25%	50%	75%	system
993003	993663	995458	curve25519
1087983	1088049	1093724	kummer
4202558	4203976	4207772	nistp256
4234947	4420737	4439451	sclaus1024
5589704	5590396	5596390	ed521gs
6742146	6748286	6748784	nist521gs
20122857	20396656	20678548	sclaus2048
25006871	25028624	25055842	claus

riscv64; U54 (sifive,u54-mc); 2017 SiFive Freedom U540; 4 x 1000MHz; `riscvunleashed000`, `supercop-20210326`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
1176291	1176624	1191114	T: kummer
1332777	1333831	1350970	T: curve25519
1792948	1797783	1817687	T: nistp256
6035312	6051076	6062589	T: ed521gs
7185443	7186713	7198473	T: nist521gs
13742830	13754983	13762774	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
1176017	1176157	1189878	T: kummer
1331496	1332360	1349154	T: curve25519
3494268	3494893	3495869	T: nistp256
6033781	6048489	6050121	T: ed521gs
7183650	7184938	7186026	T: nist521gs
13675066	13687602	13699928	T: claus

amd64; Zen (800f12); 2017 AMD EPYC 7501; 32 x 2000MHz; unstable; `colossus5`, `supercop-20210125`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
27500	28060	28680	T: kumjacfp127g
27980?	30540?	36080?	T: jacfp127i
29920	30940	31840	T: prjfp127i
36520	38720	41680	T: hecfp127i
41440	42600	45240	T: ecfp256e
42420	44540	47160	T: hecfp128fkt
43660	44880	46180	T: hecfp128i
42980	45060	49220	T: prjfp128bk
43980	45720	50540	T: hecfp128bk
44400	45940	47600	T: jacfp128bk
45140	46300	50160	T: curve2251
46260	49380	57780	T: ecfp256s
45940?	50680?	59540?	T: ecfp256h
48240	51640	59280	T: ecfp256q
51640	51940	52500	T: gls254
53080	53200	54420	T: gls254prot
64800	64820	65360	T: k277taa
64900	65600	66500	T: gls1271
76360	76540	77280	T: k298
93480	93840	93940	T: k277mon
101720	101960	102080	T: kummer
101980	102060	102140	T: kumfp127g
133380	133440	133520	T: kumfp128g
144340	144440	150280	T: curve25519
185480	186320	187800	T: ecfp256i
236760	237420	239040	T: ed448goldilocks
266280	268740	271400	T: sclaus1024
337600	338140	346520	T: nistp256
1025440	1028200	1040120	T: ed521gs
1193560	1196640	1206080	T: nist521gs
1339820	1343540	1349060	T: claus
1346920	1359380	1369280	T: sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
49660	49680	49860	T: gls254
53080	53200	54240	T: gls254prot
64720	64800	65180	T: k277taa
76260	76320	76440	T: k298
93140	93420	93620	T: k277mon
101680	101820	102020	T: kummer
104480	104500	104540	T: kumfp127g
104920	105000	105220	T: jacfp128bk
106340	106380	106480	T: kumjacfp127g
126760	126820	126920	T: prjfp128bk
130100	130340	130840	T: hecfp128bk
135280	135360	135460	T: hecfp128fkt
139280	139300	139360	T: kumfp128g
156840	157400	158900	T: curve25519
162580	162720	162880	T: jacfp127i
162320	163500	164540	T: curve2251
165780	167580	170840	T: gls1271
173760	173920	174100	T: ecfp256e
183020	183120	183360	T: ecfp256i
183760	184040	184560	T: ecfp256q
203900	204020	204440	T: prjfp127i
207240	207320	207400	T: hecfp127i
216180	216320	216420	T: ecfp256h
235780	235960	236260	T: ecfp256s
279440	280420	281360	T: sclaus1024
285800	286040	286440	T: hecfp128i
687360	688840	688980	T: ed448goldilocks
865500	865780	866200	T: nistp256
1024780	1025700	1041580	T: ed521gs
1192620	1195240	1213300	T: nist521gs
1334160	1335540	1340600	T: claus
1371360	1377440	1387380	T: sclaus2048

amd64; Zen (800f12); 2017 AMD EPYC 7451; 48 x 2300MHz; unstable; `firefly`, `supercop-20201130`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
34707	36593	39698	T: jacfp127i
35052	36754	38939	T: prjfp127i
36731	38939	42320	T: hecfp127i
38410	41262	43125	T: kumjacfp127g
42136	44666	47771	T: jacfp128bk
45471	46391	51980	T: curve2251
48047	51474	54487	T: prjfp128bk
49174	52532	56741	T: hecfp128bk
48990	52992	56327	T: hecfp128fkt
55177	56971	59708	T: hecfp128i
56534	57224	57960	T: gls254prot
56925	57684	58420	T: ecfp256h
59156	59823	62054	T: gls254
59340	61134	64078	T: ecfp256q
68885	68954	69046	T: k277taa
69483	69943	71461	T: ecfp256e
75141	75532	76015	T: ecfp256s
89102	89654	90068	T: k298
107617	107663	113620	T: kummer
114862	128616	134435	T: kumfp127g
128087	129720	136206	T: k277mon
150535	155066	158447	T: curve25519
163783	164105	183724	T: kumfp128g
236693	239384	259969	T: ecfp256i
255001	258957	271216	T: sclaus1024
263718	266294	291134	T: surf127eps
270158	279473	301162	T: ed448goldilocks
431296	432722	470166	T: nistp256
664999	813625	820594	T: surf2113
1132290	1145469	1158694	T: sclaus2048
1504269	1532651	1606343	T: claus
1487203	1585229	1636013	T: ed521gs
1907206	1934990	1982899	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
56396	57132	57500	T: gls254prot
59087	59731	62491	T: gls254
68793	68862	68931	T: k277taa
87929	89125	89861	T: k298
108307	108537	113551	T: kummer
114977	123579	124200	T: jacfp128bk
127926	129559	135884	T: k277mon
116610	130364	136206	T: kumfp127g
120106?	138943?	152927?	T: kumjacfp127g
146671	147706	164611	T: hecfp128fkt
138276	147729	149109	T: prjfp128bk
141404	152720	153433	T: hecfp128bk
160563	163875	164611	T: curve2251
168452	168728	188485	T: kumfp128g
166359	169487	171304	T: curve25519
192211	203021	203550	T: jacfp127i
216867	221996	236463	T: ecfp256q
230368	230920	237245	T: ecfp256e
233404	234071	257485	T: ecfp256i
236279	236647	236992	T: prjfp127i
238832	240833	254058	T: hecfp127i
257278	262338	282440	T: surf127eps
251114	262729	277127	T: sclaus1024
267099	272113	274252	T: ecfp256h
296631	298333	298954	T: ecfp256s
341251	355051	355373	T: hecfp128i
657478?	820203?	822802?	T: surf2113
857118	875817	972739	T: ed448goldilocks
1136315	1146090	1162903	T: sclaus2048
1424689	1523359	1605699	T: claus
1432946	1556502	1597189	T: nistp256
1486996	1578490	1648525	T: ed521gs
1907620	1938049	1997665	T: nist521gs

amd64; Zen (800f11); 2017 AMD Ryzen 7 1700; 8 x 3000MHz; `rumba7`, `supercop-20211108`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
28522	29448	30465	T: jacfp127i
29235	30018	30923	T: kumjacfp127g
32500	33641	35048	T: prjfp127i
32873	33826	35155	T: hecfp127i
37869	38838	39785	T: jacfp128bk
39958	40907	43432	T: curve2251
40097	41164	43930	T: ecfp256e
40965	42352	44282	T: hecfp128i
43562	43674	43903	T: gls254
42913	43973	44931	T: prjfp128bk
43272	44391	45405	T: hecfp128fkt
43852	44572	45593	T: hecfp128bk
44791	44813	44879	T: gls254prot
43700	45950	51371	T: ecfp256h
44664	46737	51654	T: ecfp256s
47112	49230	53959	T: ecfp256q
55680	55904	55975	T: k277taa
66971	67174	67423	T: k298
67243	67966	68535	T: gls1271
87075	87223	87260	T: k277mon
95119	95211	95691	T: kummer
101898	101961	102028	T: kumfp127g
133273	133326	133386	T: kumfp128g
144498	144528	149366	T: curve25519
184708	185586	186939	T: ecfp256i
186957	187598	187931	T: surf127eps
199453	199615	199901	T: ed448goldilocks
201458	203043	204976	T: sclaus1024
272760	272901	273454	T: nistp256
530694	533435	534721	T: surf2113
896534	897672	899498	T: ed521gs
988744	997326	1006009	T: sclaus2048
1094801	1096097	1140749	T: nist521gs
1191652	1195375	1198766	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
42435	42447	42464	T: gls254
44745	44773	44820	T: gls254prot
55740	55829	55899	T: k277taa
67006	67098	67182	T: k298
87159	87199	87221	T: k277mon
95066	95110	95659	T: kummer
103827	103928	104014	T: jacfp128bk
104383	104447	104566	T: kumfp127g
106275	106395	106493	T: kumjacfp127g
126640	126716	126887	T: prjfp128bk
129849	129963	130091	T: hecfp128bk
134558	134718	134839	T: hecfp128fkt
139129	139171	139210	T: kumfp128g
157200	158972	172551	T: curve25519
159523	160098	160800	T: curve2251
162475	162546	162826	T: jacfp127i
163447	163711	167613	T: gls1271
173433	173525	173602	T: ecfp256e
181951	182171	182296	T: ecfp256i
183317	183597	183685	T: ecfp256q
183372	183765	184261	T: surf127eps
197493	203312	204718	T: sclaus1024
203515	203813	204255	T: prjfp127i
207447	207622	209398	T: hecfp127i
216350	216397	216500	T: ecfp256h
235470	235809	236609	T: ecfp256s
285827	286103	287064	T: hecfp128i
527494	532035	532498	T: surf2113
586294	586995	589535	T: ed448goldilocks
663841	664045	664435	T: nistp256
895604	897628	899323	T: ed521gs
985451	989803	1004919	T: sclaus2048
1095547	1096742	1143434	T: nist521gs
1185630	1194512	1200167	T: claus

amd64; Zen (800f11); 2017 AMD Ryzen 5 1600; 6 x 3200MHz; `rumba5`, `supercop-20211108`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
29820	30575	31661	T: jacfp127i
29890	30910	32174	T: kumjacfp127g
32881	34168	35893	T: prjfp127i
33820	34964	36552	T: hecfp127i
38198	39529	40743	T: jacfp128bk
39855	41197	44646	T: curve2251
40587	41807	44913	T: ecfp256e
43536	44423	45548	T: prjfp128bk
44791	44813	44879	T: gls254prot
44716	44879	45045	T: gls254
43949	45104	46195	T: hecfp128bk
44240	45297	46076	T: hecfp128fkt
44406	45384	46225	T: hecfp128i
44464	46640	52357	T: ecfp256h
45227	47437	52715	T: ecfp256s
47746	50177	55743	T: ecfp256q
55670	55824	55956	T: k277taa
64847	65443	65725	T: k298
66231	66938	67681	T: gls1271
87097	87190	87290	T: k277mon
95114	95656	95690	T: kummer
101854	101937	102021	T: kumfp127g
133254	133321	133375	T: kumfp128g
144562	144581	144616	T: curve25519
184723	185692	186967	T: ecfp256i
187228	187899	188320	T: surf127eps
199328	199526	199805	T: ed448goldilocks
201041	202596	204636	T: sclaus1024
273658	273821	273974	T: nistp256
531504	533908	536114	T: surf2113
895508	896733	899010	T: ed521gs
990003	998299	1006779	T: sclaus2048
1095713	1096749	1097764	T: nist521gs
1190513	1194051	1197808	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
42165	42183	42201	T: gls254
44736	44764	44814	T: gls254prot
55718	55815	55906	T: k277taa
64674	64723	64777	T: k298
87071	87140	87216	T: k277mon
95017	95637	95640	T: kummer
104400	104463	104516	T: kumfp127g
104390	104489	104617	T: jacfp128bk
106331	106396	106466	T: kumjacfp127g
126456	126512	126600	T: prjfp128bk
130022	130152	130321	T: hecfp128bk
134518	134612	134757	T: hecfp128fkt
139092	139122	139313	T: kumfp128g
157260	157515	159050	T: curve25519
159897	161339	161986	T: curve2251
162475	162670	162797	T: jacfp127i
159990	164133	165312	T: gls1271
173521	173761	174755	T: ecfp256e
181997	182175	182346	T: ecfp256i
183262	183355	183501	T: ecfp256q
183564	184818	185061	T: surf127eps
197840	201320	202203	T: sclaus1024
203935	204135	205185	T: prjfp127i
207366	207491	207692	T: hecfp127i
216169	216277	216409	T: ecfp256h
235661	235744	235977	T: ecfp256s
285464	285708	286026	T: hecfp128i
532518	533309	535304	T: surf2113
588527	590392	590617	T: ed448goldilocks
664008	664208	665032	T: nistp256
895079	896875	897726	T: ed521gs
981121	1000432	1015455	T: sclaus2048
1093802	1094939	1095910	T: nist521gs
1191120	1192145	1200226	T: claus

amd64; Zen (800f11); 2017 AMD Ryzen 3 1200; 4 x 3100MHz; `rumba3`, `supercop-20200906`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
29171	29853	31062	T: jacfp127i
29636	30628	31527	T: kumjacfp127g
32736	33945	35247	T: prjfp127i
33325	34472	35898	T: hecfp127i
38223	39184	40610	T: jacfp128bk
40114	40610	42625	T: curve2251
40455	41726	44609	T: ecfp256e
43586	43772	44051	T: gls254
43524	44485	45663	T: hecfp128fkt
43555	44516	45911	T: prjfp128bk
44795	44826	44888	T: gls254prot
43958	45012	46035	T: hecfp128i
43989	45012	46190	T: hecfp128bk
43741	46345	50964	T: ecfp256h
44857	46903	51801	T: ecfp256s
47771	49383	54560	T: ecfp256q
55149	55211	55242	T: k277taa
64821	65472	65658	T: k298
87079	87234	92287	T: k277mon
95542	95604	95914	T: kummer
101928	102052	102548	T: kumfp127g
133362	133393	133486	T: kumfp128g
144491	144584	144615	T: curve25519
185132	186124	187457	T: ecfp256i
187271	188139	189906	T: surf127eps
199423	199671	200291	T: ed448goldilocks
202771	205282	209684	T: sclaus1024
273761	273916	274908	T: nistp256
530999	533076	533820	T: surf2113
897047	898318	899744	T: ed521gs
995100	1003408	1010693	T: sclaus2048
1097989	1099260	1100500	T: nist521gs
1192849	1195949	1199824	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
42408	42439	42935	T: gls254
44764	44795	45446	T: gls254prot
55056	55180	55211	T: k277taa
64821	64914	65441	T: k298
87017	87203	92132	T: k277mon
95511	95635	95914	T: kummer
103912	104098	104656	T: jacfp128bk
104377	104501	106144	T: kumfp127g
106361	106423	106485	T: kumjacfp127g
126387	126728	126945	T: prjfp128bk
129859	130293	130386	T: hecfp128bk
134478	134602	134695	T: hecfp128fkt
139190	139221	139283	T: kumfp128g
160177	161045	161851	T: curve2251
162440	162502	162688	T: jacfp127i
158689	163432	172608	T: curve25519
173321	173445	173569	T: ecfp256e
182249	182435	182528	T: ecfp256i
182683	183055	184295	T: surf127eps
183458	183582	184574	T: ecfp256q
204104	204228	204445	T: prjfp127i
207018	207266	208568	T: hecfp127i
206987	207297	210676	T: sclaus1024
215977	216039	216132	T: ecfp256h
235786	235879	236003	T: ecfp256s
285758	287401	287990	T: hecfp128i
530472	530813	532704	T: surf2113
587977	589000	589868	T: ed448goldilocks
664423	664733	676606	T: nistp256
895125	896210	896737	T: ed521gs
989706	1000153	1013979	T: sclaus2048
1098330	1099942	1101957	T: nist521gs
1189439	1192167	1199235	T: claus

amd64; KabyLake (906e9); 2017 Intel Xeon E3-1220 v6; 4 x 3000MHz; `kizomba`, `supercop-20211108`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
20851	21905	23770	T: kumjacfp127g
22036	23085	24459	T: jacfp127i
26111	27143	28889	T: prjfp127i
25792	27405	30594	T: hecfp127i
30881	32228	34799	T: jacfp128bk
35002	36536	38685	T: prjfp128bk
36873	37170	42381	T: gls254
38099	38258	39401	T: curve2251
37567	38663	41037	T: hecfp128bk
37716	38750	39881	T: hecfp128i
38797	38859	38929	T: gls254prot
37448	38905	42046	T: hecfp128fkt
42740	43700	48925	T: ecfp256e
45748	45901	46000	T: k277taa
45272	46051	50689	T: ecfp256h
47411	48044	50655	T: ecfp256s
48104	49067	54722	T: ecfp256q
50220	50478	50621	T: kummer
52500	52621	52822	T: k298
69947	70170	70414	T: k277mon
69669	70559	74691	T: gls1271
79186	79307	79410	T: kumfp127g
110575	110654	115361	T: kumfp128g
125299	127466	130839	T: curve25519
153137	153645	159359	T: ed448goldilocks
175730	177926	182206	T: sclaus1024
180933	181688	186841	T: surf127eps
189793	191131	196818	T: ecfp256i
234534	235076	240404	T: nistp256
492555	495274	515714	T: surf2113
810139	815290	854933	T: ed521gs
903210	953304	986315	T: sclaus2048
944671	960199	997258	T: nist521gs
980736	994998	1035344	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
35685	35734	35786	T: gls254
38482	38528	38587	T: gls254prot
45477	45552	45762	T: k277taa
50047	50214	50711	T: kummer
52204	52294	52379	T: k298
69907	70103	70298	T: k277mon
81385	81494	86327	T: kumfp127g
82822	82925	87703	T: kumjacfp127g
88004	88081	88213	T: jacfp128bk
108696	108881	109298	T: prjfp128bk
112387	112521	117323	T: hecfp128bk
115789	115855	120804	T: kumfp128g
119224	119557	124262	T: hecfp128fkt
124360	124494	129690	T: jacfp127i
135216	137258	140010	T: curve25519
144609	144792	150490	T: curve2251
165054	165224	165556	T: prjfp127i
167161	167326	168416	T: hecfp127i
171686	172744	176702	T: gls1271
175597	175847	181095	T: ecfp256e
176345	177919	183298	T: surf127eps
174165	178496	183189	T: sclaus1024
184776	185024	190282	T: ecfp256i
185274	185635	192729	T: ecfp256q
217976	218307	223321	T: ecfp256h
237461	237744	243424	T: ecfp256s
251448	251812	257952	T: hecfp128i
456494	457581	476097	T: ed448goldilocks
491102	493428	513579	T: surf2113
577334	583032	617388	T: nistp256
810129	820489	858772	T: ed521gs
943736	953557	992889	T: nist521gs
913989	955709	983087	T: sclaus2048
965851	978851	1017369	T: claus

amd64; KabyLake (806e9); 2017 Intel Core i7-7567U; 2 x 3500MHz; unstable; `intelnuci7`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
22854	24024	25244	T: jacfp127i
23076	24178	25666	T: kumjacfp127g
25138	26386	27910	T: hecfp127i
26244	27416	29766	T: prjfp127i
31346	32408	33938	T: jacfp128bk
36088	37424	39956	T: hecfp128i
36862	38122	40248	T: hecfp128fkt
37220	38230	39526	T: prjfp128bk
38020	38250	38618	T: gls254
39342	39458	40200	T: curve2251
38304	39606	41796	T: hecfp128bk
40044	40110	40194	T: gls254prot
43854	44594	45714	T: ecfp256e
47236	47288	47348	T: k277taa
46768	47648	49566	T: ecfp256h
47006	47776	49534	T: ecfp256s
49462	50440	52650	T: ecfp256q
51894	52200	52956	T: kummer
54288	54370	54510	T: k298
72248	72378	72610	T: k277mon
71994	72788	73588	T: gls1271
81552	81646	81752	T: kumfp127g
114092	114148	114208	T: kumfp128g
129368	129626	129896	T: curve25519
158112	158318	158604	T: ed448goldilocks
180542	182522	184208	T: sclaus1024
186540	187234	187858	T: surf127eps
195688	196738	197926	T: ecfp256i
217550	226366	238000	T: hector
242064	242480	270748	T: nistp256
508152	510326	511366	T: surf2113
836516	836864	837546	T: ed521gs
913382	920252	927792	T: sclaus2048
970706	971326	972396	T: nist521gs
1006838	1008496	1011858	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
36850	36928	36980	T: gls254
39768	39814	39892	T: gls254prot
46934	46980	47032	T: k277taa
51804	52124	52280	T: kummer
54098	54176	54274	T: k298
72352	72518	74482	T: k277mon
83886	83962	84030	T: kumfp127g
85274	85362	85450	T: kumjacfp127g
90890	90990	91088	T: jacfp128bk
111918	112022	112158	T: prjfp128bk
118500	118660	118848	T: hecfp128bk
119418	119482	119546	T: kumfp128g
122602	122806	123004	T: hecfp128fkt
127970	128042	128146	T: jacfp127i
139286	139568	140018	T: curve25519
148680	149586	149718	T: curve2251
170368	170516	170720	T: prjfp127i
173236	173498	175470	T: hecfp127i
174868	179314	179672	T: gls1271
172194	180938	185840	T: sclaus1024
181232	181406	181554	T: ecfp256e
183398	183722	184034	T: surf127eps
190906	191084	191228	T: ecfp256i
191248	191408	191566	T: ecfp256q
225138	225284	225548	T: ecfp256h
245790	246000	246200	T: ecfp256s
256004	256202	256392	T: hecfp128i
471048	471346	471646	T: ed448goldilocks
505542	506108	508468	T: surf2113
595818	596138	596506	T: nistp256
740472	746538	753674	T: hector
836072	836278	836634	T: ed521gs
912476	915646	935020	T: sclaus2048
970230	970696	972034	T: nist521gs
991354	993798	1041200	T: claus

aarch64; A57+crypto (411fd072); 2016 AMD Opteron A1100; 8 x 2000MHz; `warbear0`, `supercop-20200826`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
242272	242272	242288	T: kummer
338112	338800	339216	T: curve25519
367424	367440	367584	T: nistp256
1971904	1972368	1976800	T: ed521gs
2440928	2444240	2445904	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
240848	240848	240848	T: kummer
338032	338160	338736	T: curve25519
1269552	1269584	1270144	T: nistp256
1969392	1970768	1971424	T: ed521gs
2439696	2443104	2445712	T: nist521gs

aarch64; A53+crypto (410fd034); 2016 HiSilicon Kirin 960; 8 x 1844MHz; unstable; `hikey960spare`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
199800	241425	249750	kummer
274725?	283050?	524475?	nistp256
324675	324675	402019	curve25519
382950?	391275?	532800?	surf127eps
432900?	549450?	2897570?	sclaus1024
1039311?	1948050?	3804525?	nist521gs
2355975	2872125	2880450	ed521gs
1749951?	3274476?	6418575?	claus
2439225?	5169825?	5219775?	sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
199800	199800	249750	kummer
324675?	333000?	983176?	curve25519
382950?	599400?	774225?	surf127eps
957375?	957375?	1739925?	nistp256
541125?	1115550?	4486560?	sclaus1024
1039311?	1939725?	3796200?	nist521gs
1498500?	2056275?	2872125?	ed521gs
1758834?	3257812?	6368625?	claus
2439225?	3679650?	5144850?	sclaus2048

aarch64; A53+crypto (410fd034); 2016 Amlogic S905X; 4 x 1512MHz; `lepotatoamls905xcc`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
421378	421418	421920	kummer
469366	469428	469496	curve25519
472032	472306	472790	nistp256
603780	606656	608668	surf127eps
1057881	1067305	1081255	sclaus1024
3052507	3058532	3084285	ed521gs
3558462	3562320	3585426	nist521gs
5174769	5210654	5259810	sclaus2048
6375132	6385536	6399878	claus

Cycles to compute a shared secret
25%	50%	75%	system
421288	421306	421468	kummer
475747	475759	475878	curve25519
602135	604397	608238	surf127eps
1049959	1079070	1083797	sclaus1024
1589988	1590123	1597162	nistp256
3048255	3056833	3060699	ed521gs
3556354	3562450	3566311	nist521gs
5172784	5249509	5305320	sclaus2048
6339806	6399359	6415571	claus

armeabi; A53 (410fd034); 2016 Broadcom BCM2837; 4 x 1200MHz; unstable; `rpi3b`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
368373	399873	420498	kummer
511934	536997	566309	curve25519
1444619	1486742	1582117	nistp256
3928544	4122729	4726914	sclaus1024
17697537	18333160	19505902	sclaus2048
23150072	24497191	25776435	claus

Cycles to compute a shared secret
25%	50%	75%	system
371435	388247	413561	kummer
510872	536185	565560	curve25519
3910480	4000292	4075417	sclaus1024
4907663	5050100	5170599	nistp256
18005473	18435158	19107529	sclaus2048
25265374	25869746	26363055	claus

armeabi; Cortex-A7 (410fc075); 2016 Broadcom BCM2836; 4 x 900MHz; `berry2`, `supercop-20210604`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
596059	606294	617958	T: kummer
926474	933209	945204	T: curve25519
1321065	1379146	1460532	T: nistp256
3470183	3506143	3539488	T: sclaus1024
11236095	11643481	11790584	T: claus
15870647	16010357	16116442	T: sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
593045	602253	615798	T: kummer
926023	932715	940291	T: curve25519
3568639	3593336	3603000	T: sclaus1024
4695297	4869236	5005629	T: nistp256
11340650	11638921	11839912	T: claus
15909068	16179189	16232908	T: sclaus2048

amd64; BW+AES (406f1); 2016 Intel Xeon E5-2609 v4; 8 x 1700MHz; `bolero`, `supercop-20211108`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
24588	25420	27984	T: jacfp127i
25792	26688	31012	T: kumjacfp127g
28360	29436	35376	T: prjfp127i
28180?	32376?	37508?	T: hecfp127i
31628	33056	36380	T: jacfp128bk
37640	37924	43296	T: gls254
39280	39448	44140	T: gls254prot
38456	39820	45752	T: hecfp128fkt
40300	41044	46316	T: curve2251
40440	41272	45988	T: hecfp128bk
38156	41440	45984	T: prjfp128bk
41000	43268	46268	T: hecfp128i
43520	46608	51084	T: ecfp256e
49304	49580	58872	T: k277taa
49492	51612	59664	T: ecfp256s
51372	52876	61552	T: ecfp256q
48252?	53236?	62840?	T: ecfp256h
55468	59280	66060	T: k298
60096	60800	69232	T: kummer
73288	74476	82648	T: k277mon
78200	82652	91916	T: gls1271
82776	83956	95596	T: kumfp127g
130188	135096	149968	T: kumfp128g
143092	151868	166536	T: curve25519
157132	163572	186188	T: ed448goldilocks
193244	200420	224812	T: sclaus1024
198460	206984	230792	T: surf127eps
203320	210888	231428	T: ecfp256i
248712	258988	288812	T: nistp256
628124	663608	707548	T: surf2113
942132	979728	1026328	T: ed521gs
994356	1031132	1064904	T: sclaus2048
1042852	1074800	1110968	T: claus
1086972	1129916	1172100	T: nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
36156	36428	41940	T: gls254
39192	39240	39392	T: gls254prot
49244	53704	58948	T: k277taa
55284	55452	65836	T: k298
60364	63020	68968	T: kummer
73164	73264	83328	T: k277mon
86708	91332	103028	T: kumfp127g
93216	96296	107356	T: kumjacfp127g
96036	96348	105676	T: jacfp128bk
117200	121948	132768	T: prjfp128bk
120876	125448	135496	T: hecfp128bk
127920	132844	150784	T: hecfp128fkt
135508	140492	160040	T: kumfp128g
142748	147420	161284	T: curve25519
153812	159504	172492	T: curve2251
155180	160152	180432	T: jacfp127i
187456	192864	218240	T: hecfp127i
185368	194672	219028	T: prjfp127i
186184	195664	214964	T: ecfp256e
193544	199072	225748	T: gls1271
192640	199460	221920	T: surf127eps
192904	199956	221072	T: ecfp256q
193136	202444	223864	T: sclaus1024
201368	206128	229092	T: ecfp256i
233548	238596	263568	T: ecfp256h
252664	262600	290032	T: ecfp256s
276500	286984	315484	T: hecfp128i
479064	509576	532548	T: ed448goldilocks
631448	665560	689612	T: surf2113
632120	670704	701804	T: nistp256
953380	989436	1026480	T: ed521gs
973888	1004756	1058408	T: sclaus2048
1040488	1081068	1114844	T: claus
1084708	1121460	1167224	T: nist521gs

aarch64; A53+crypto (410fd034); 2015 NXP QorIQ LS1088; 8 x 1600MHz; `ten64`, `supercop-20210604`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
423808	423808	423808	T: kummer
469632	470272	470464	T: curve25519
482496	482816	483392	T: nistp256
566784	569280	570752	T: surf127eps
982080	992512	1003136	T: sclaus1024
3096256	3102272	3104896	T: ed521gs
3682432	3689344	3690944	T: nist521gs
4828992	4864960	4911872	T: sclaus2048
5186560	5188608	5210560	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
423488	423488	423744	T: kummer
476032	476096	476352	T: curve25519
568448	569472	570112	T: surf127eps
978944	988544	999424	T: sclaus1024
1651776	1651840	1658944	T: nistp256
3096704	3102656	3104000	T: ed521gs
3680448	3687104	3687360	T: nist521gs
4787136	4838016	4860352	T: sclaus2048
5176128	5177472	5180032	T: claus

amd64; Skylake (506e3); 2015 Intel Xeon E3-1220 v5; 4 x 3000MHz; `samba`, `supercop-20211108`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
20914	21195	22503	T: kumjacfp127g
20381	21596	22906	T: jacfp127i
23971	24815	26513	T: prjfp127i
26467	27794	29597	T: hecfp127i
29362	30190	31508	T: jacfp128bk
34215	35247	36857	T: prjfp128bk
36792	37032	37419	T: gls254
36310	37247	38398	T: hecfp128i
36994	37844	40048	T: hecfp128fkt
38016	38222	38974	T: curve2251
38036	38781	39588	T: hecfp128bk
38813	38849	38891	T: gls254prot
42132	42746	44037	T: ecfp256e
45692	45720	45760	T: k277taa
45058	45778	47147	T: ecfp256s
45569	46554	48222	T: ecfp256h
47827	48693	50947	T: ecfp256q
50173	50264	50956	T: kummer
52474	52567	52709	T: k298
69757	69823	69901	T: k277mon
69678	70597	71320	T: gls1271
78354	78413	78500	T: kumfp127g
110376	110423	110489	T: kumfp128g
125110	125388	125606	T: curve25519
152870	153083	153362	T: ed448goldilocks
175817	177084	178931	T: sclaus1024
182438	183033	183629	T: surf127eps
189268	190317	191746	T: ecfp256i
233987	234506	235182	T: nistp256
581091	584077	590116	T: surf2113
810090	810493	811974	T: ed521gs
887848	896855	923533	T: sclaus2048
936762	937518	938808	T: nist521gs
967712	968534	970174	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
35732	35783	35840	T: gls254
38559	38594	38643	T: gls254prot
45507	45531	45562	T: k277taa
50502	50640	54145	T: kummer
52257	52378	52509	T: k298
69684	69731	69782	T: k277mon
80660	80738	80821	T: kumfp127g
82615	82705	82787	T: kumjacfp127g
88170	88240	88323	T: jacfp128bk
108575	108701	108830	T: prjfp128bk
114838	115005	115173	T: hecfp128bk
115505	115558	115621	T: kumfp128g
119075	119229	119402	T: hecfp128fkt
124060	124160	124262	T: jacfp127i
134799	135148	135334	T: curve25519
145746	145828	145975	T: curve2251
165141	165294	165433	T: prjfp127i
167193	167317	167521	T: hecfp127i
168744	171585	172476	T: gls1271
175217	175358	175502	T: ecfp256e
174675	176508	177360	T: sclaus1024
177703	178296	178748	T: surf127eps
184841	184983	185182	T: ecfp256i
185217	185385	185580	T: ecfp256q
217625	217812	218051	T: ecfp256h
237809	237983	238228	T: ecfp256s
248097	248333	248621	T: hecfp128i
456281	456622	456889	T: ed448goldilocks
577999	578173	578442	T: nistp256
586934	590649	594453	T: surf2113
809506	809756	810839	T: ed521gs
891043	911181	934361	T: sclaus2048
936514	937023	938031	T: nist521gs
962205	964952	966399	T: claus

amd64; BW+AES (306d4); 2015 Intel Core i5-5350U; 2 x 1800MHz; unstable; `luft`, `supercop-20200702`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
48404	49352	50144	gls254
52468	52672	52840	gls254prot
63512	64496	68968	k277taa
76216	76816	79544	k298
84360	85840	87200	kummer
100828	107472	111260	k277mon
270472	296904	305632	curve25519
319844	329440	332672	ed448goldilocks
340196	368524	380824	surf127eps
350576	377888	391764	sclaus1024
499756	538332	550092	nistp256
1081420	1114288	1129628	surf2113
1183808	1233692	1254712	curve2251
1760260	1842984	1935860	sclaus2048
1803352	1914912	1921716	ed521gs
2170020	2264624	2362708	claus
2137104	2282876	2372176	nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
46760	47428	48676	gls254
49744	50640	52432	gls254prot
62616	63568	68740	k277taa
75128	75844	76364	k298
82916	84084	84520	kummer
98276	105660	111120	k277mon
283904	298712	307000	curve25519
339992	369712	375216	surf127eps
385252	389448	396764	sclaus1024
1027956	1053832	1055768	ed448goldilocks
1086304	1093652	1124016	surf2113
1213276	1219068	1260148	curve2251
1246396	1323436	1381256	nistp256
1783820	1888848	1921604	ed521gs
1850868	1907036	1995280	sclaus2048
2144440	2309164	2567204	nist521gs
2216580	2346548	2437328	claus

armeabi; Cortex-A17 (410fc0d1); 2014 Rockchip RK3288; 4 x 1800MHz; unstable; `tinkerboards`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
249600	253004	258443	kummer
336762	338974	348601	curve25519
791779	819580	861360	nistp256
889648	900648	911076	sclaus1024
1195357	1226374	1258318	surf127eps
4565818	4617368	4695739	sclaus2048
5347311	5406074	5518546	claus

Cycles to compute a shared secret
25%	50%	75%	system
249810	253380	261147	kummer
336562	339414	346077	curve25519
888418	911512	931079	sclaus1024
1229776	1255150	1279979	surf127eps
2754934	2822070	2928463	nistp256
4561207	4611164	4727109	sclaus2048
5365762	5486668	5531147	claus

armeabi; Cortex-A17 (410fc0d1); 2014 Rockchip RK3288; 4 x 1512MHz; unstable; `tinkerboard`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
261532	290595	323203	kummer
338086?	411868?	438368?	curve25519
797554	833486	962534	nistp256
906738	920233	935792	sclaus1024
1187424	1192731	1199272	surf127eps
5339135	5356332	5439375	claus
5236833	5484234	5684342	sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
260459	291273	320152	kummer
337918?	401928?	437315?	curve25519
916814	927206	941386	sclaus1024
1183700	1190112	1194014	surf127eps
2778164	2843943	3237181	nistp256
5233622	5459550	5629713	sclaus2048
5340239	5461323	5480193	claus

amd64; HW+AES (306f2); 2014 Intel Xeon E5-1630 v3; 4 x 3700MHz; unstable; `wyvern1`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
41304	41943	45140	curve2251
46294	46842	47469	ecfp256e
45614?	48544?	67271?	ecfp256h
48541	48961	49326	gls254
48041	49720	53992	ecfp256s
50657	50714	50764	gls254prot
51389	55086	60736	ecfp256q
61980	62136	62356	kummer
68047	68130	68231	k277taa
95635	95679	95738	k277mon
140707	140789	142429	curve25519
192361	192767	193211	ed448goldilocks
208603	209423	209965	surf127eps
211732	214245	216361	sclaus1024
215678?	217406?	281669?	ecfp256i
344858	344956	345106	nistp256
606812	609337	610387	surf2113
1060565	1061263	1062282	ed521gs
1061133	1070949	1077937	sclaus2048
1191370	1192146	1192936	nist521gs
1485340	1485837	1486980	claus

Cycles to compute a shared secret
25%	50%	75%	system
47348	47381	47437	gls254
50536	50560	50610	gls254prot
61812	61956	62344	kummer
67950	68009	68077	k277taa
95522	95567	95635	k277mon
151922	151984	152038	curve25519
156072	156240	156563	curve2251
199735	199838	199966	ecfp256e
200999	202742	203216	surf127eps
208245	208470	232616	ecfp256q
212747?	212936?	269340?	ecfp256i
213277	214482	215876	sclaus1024
241462?	241651?	352723?	ecfp256h
265915	266196	273184	ecfp256s
596493	596771	597059	ed448goldilocks
601475	601818	602940	surf2113
888980	889382	889876	nistp256
961584	962428	963024	claus
1060299	1060595	1061873	ed521gs
1053988	1082851	1086501	sclaus2048
1191258	1191906	1192469	nist521gs

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1275 V3; 4 x 3500MHz; `titan0`, `supercop-20211108`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
33637	35147	36584	T: jacfp127i
35385	36018	36586	T: hecfp127i
35169	36381	37990	T: kumjacfp127g
37378	38791	40346	T: prjfp127i
41381	42780	46946	T: curve2251
43131	44568	46197	T: jacfp128bk
45154	45694	46350	T: gls254
47838	48771	49647	T: hecfp128i
49540	49601	49664	T: gls254prot
49583	50304	51216	T: ecfp256e
49288	51045	52725	T: prjfp128bk
49812	51096	55856	T: ecfp256s
49619	51859	55800	T: ecfp256h
51167	52577	53946	T: hecfp128bk
51306	52860	54151	T: hecfp128fkt
54926	56761	62585	T: ecfp256q
60425	60476	60531	T: kummer
63261	63304	63355	T: k277taa
70110	70213	70365	T: k298
91018	92088	93205	T: gls1271
97091	97164	97219	T: k277mon
110159	110304	110482	T: kumfp127g
144527	146907	148208	T: curve25519
155900	155963	156079	T: kumfp128g
176681	176906	177163	T: ed448goldilocks
213925	214640	215122	T: surf127eps
218608	220593	222147	T: sclaus1024
223346	225457	229171	T: ecfp256i
273184	273426	273766	T: nistp256
617883	620659	622265	T: surf2113
1032022	1033335	1039184	T: ed521gs
1098596	1106722	1114396	T: sclaus2048
1185660	1188264	1201472	T: nist521gs
1524251	1525401	1528271	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
40015	41549	41999	T: gls254
49339	49435	49479	T: gls254prot
60384	60444	60489	T: kummer
63152	63203	63253	T: k277taa
69918	69999	70065	T: k298
96964	96989	97031	T: k277mon
112275	112607	112860	T: kumfp127g
114339	114396	114468	T: jacfp128bk
120605	120687	120777	T: kumjacfp127g
141108	141358	145705	T: prjfp128bk
147634	147768	147991	T: hecfp128bk
155409	155574	155745	T: hecfp128fkt
156066	158271	158384	T: curve25519
159698	159913	162440	T: curve2251
162128	162163	162198	T: kumfp128g
185124	185303	185516	T: jacfp127i
206508	206644	206848	T: ecfp256e
204721	208189	208731	T: surf127eps
214760	214921	215136	T: ecfp256q
219105	219452	222954	T: gls1271
219661	219787	219984	T: ecfp256i
218045	220475	223508	T: sclaus1024
226907	227058	227286	T: prjfp127i
228620	228895	229122	T: hecfp127i
249856	250026	250218	T: ecfp256h
273024	273162	273380	T: ecfp256s
325812	331163	331556	T: hecfp128i
537092	537387	538032	T: ed448goldilocks
617276	618221	620083	T: surf2113
680877	681279	682055	T: nistp256
956012	956673	958458	T: claus
1031596	1032856	1039519	T: ed521gs
1112201	1113497	1114712	T: sclaus2048
1188866	1191389	1193524	T: nist521gs

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1220 v3; 4 x 3100MHz; `hiphop`, `supercop-20211108`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
28826	29481	31246	T: kumjacfp127g
30463	31228	31938	T: jacfp127i
32737	33537	34322	T: prjfp127i
34840	36472	39029	T: hecfp127i
38597	39379	40069	T: jacfp128bk
41073	42336	46073	T: curve2251
42940	43333	45878	T: prjfp128bk
44776	45277	45948	T: gls254
44652	45394	47797	T: hecfp128fkt
46114	46773	48201	T: ecfp256e
46647	47189	49438	T: hecfp128bk
46955	48455	51426	T: hecfp128i
48406	49183	51128	T: ecfp256h
49584	49701	49835	T: gls254prot
49120	50067	52095	T: ecfp256s
54065	54964	57405	T: ecfp256q
60432	60492	60570	T: kummer
63220	63291	63367	T: k277taa
70141	70252	70450	T: k298
90904	91928	92638	T: gls1271
97115	97191	97311	T: k277mon
109858	109962	110066	T: kumfp127g
144456	144548	147220	T: curve25519
157097	157222	157331	T: kumfp128g
176643	176963	177382	T: ed448goldilocks
213351	214187	215065	T: surf127eps
218171	219732	221607	T: sclaus1024
222921	224124	225489	T: ecfp256i
272998	273404	281510	T: nistp256
618119	620972	623686	T: surf2113
1032365	1033180	1034069	T: ed521gs
1102515	1113052	1160846	T: sclaus2048
1184626	1186002	1187676	T: nist521gs
1522544	1523222	1524943	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
40059	40569	40662	T: gls254
49434	49521	49608	T: gls254prot
60408?	60506?	96147?	T: kummer
63150	63184	63225	T: k277taa
69962	70062	70166	T: k298
96972	97091	97208	T: k277mon
112345	112441	112559	T: kumfp127g
114100	114170	114261	T: jacfp128bk
120886	120964	121072	T: kumjacfp127g
140899	141042	141195	T: prjfp128bk
144967	145108	145277	T: hecfp128bk
155673	155901	156437	T: hecfp128fkt
155992	156071	158679	T: curve25519
158397	159272	160692	T: curve2251
163145	163214	163362	T: kumfp128g
185198	185574	186647	T: jacfp127i
205455	205578	205896	T: ecfp256e
207607	208324	209164	T: surf127eps
214781	214958	215182	T: ecfp256q
218932	219315	222458	T: gls1271
219693	219816	220057	T: ecfp256i
221215	224153	225103	T: sclaus1024
227258	227550	227800	T: prjfp127i
230806	231008	231273	T: hecfp127i
249957	250107	250410	T: ecfp256h
273147	273380	273744	T: ecfp256s
325154	325544	325942	T: hecfp128i
537140	537412	537880	T: ed448goldilocks
615654	620964	626760	T: surf2113
680707	681249	682505	T: nistp256
956166	957096	957906	T: claus
1032354	1033139	1034192	T: ed521gs
1111471	1123033	1168502	T: sclaus2048
1184698	1186120	1188217	T: nist521gs

armeabi; Cortex-A9+NEON (413fc090); 2012 Samsung Exynos 4412?; 4 x 1200MHz; `artik`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
370745	395407	413969	kummer
570503	577254	609728	curve25519
1635688	1732859	1860288	nistp256
4147614	4593342	4844743	sclaus1024
18175844	18481753	18786523	claus
18726427	19813812	21497901	sclaus2048

Cycles to compute a shared secret
25%	50%	75%	system
365675	385180	411494	kummer
568456	570241	591894	curve25519
4428782	4746538	5141685	sclaus1024
5297987	5555195	5787440	nistp256
18401836	18758372	19012812	claus
18357771	19049933	20056702	sclaus2048

amd64; Piledriver (610f01); 2012 AMD A10-4655M; 2 x 2000MHz; `h9trinity`, `supercop-20200618`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
66016	66523	68082	curve2251
70657	72437	75845	ecfp256e
75637	77595	81733	ecfp256h
76065	77688	81118	ecfp256s
81868	83762	87371	ecfp256q
93574	94575	95672	gls254
107429	107429	107430	gls254prot
142076	142079	142093	k277taa
171607	171643	171791	k298
179166	179180	179183	curve25519
204241	204269	204301	kummer
217271	217277	217307	k277mon
350399	352159	354592	ecfp256i
377589	378186	379075	ed448goldilocks
385246	386701	387578	surf127eps
437022	442725	450233	sclaus1024
648914	649098	649407	nistp256
691292	693890	695626	surf2113
1881145	1883729	1890648	ed521gs
2158341	2163610	2203359	nist521gs
2147939	2164446	2178584	sclaus2048
2607195	2614093	2624140	claus

Cycles to compute a shared secret
25%	50%	75%	system
85379	85806	89805	gls254
107215	107216	107217	gls254prot
141877	141884	141889	k277taa
171385	171418	171450	k298
191394	191420	191432	curve25519
204057	204078	204115	kummer
217093	217095	217096	k277mon
250621	251955	252587	curve2251
328315	328535	329086	ecfp256e
343804	344135	344705	ecfp256q
347151	347441	347915	ecfp256i
378557	382495	384400	surf127eps
413162	413312	413641	ecfp256h
432863	433252	433511	ecfp256s
440132	445787	455090	sclaus1024
682572	685063	692675	surf2113
1195697	1195751	1196535	ed448goldilocks
1280838	1280868	1281018	nistp256
1882823	1882996	1883961	ed521gs
2150228	2157035	2192115	nist521gs
2163540	2193798	2196355	sclaus2048
2600761	2604292	2608400	claus

amd64; Bulldozer (600f20); 2012 AMD FX-8350; 4 x 4000MHz; `saber214`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
44535	45420	46259	T: jacfp127i
45814	46700	47602	T: kumjacfp127g
51184	52079	53162	T: prjfp127i
51878	52625	53627	T: hecfp127i
64568	65151	67359	T: curve2251
67367	68149	69026	T: jacfp128bk
70798	73246	77900	T: ecfp256e
74728	77484	81982	T: ecfp256h
74929	77661	81294	T: ecfp256s
77522	78164	79324	T: prjfp128bk
78016	78865	80112	T: hecfp128bk
78072	78890	79997	T: hecfp128i
78656	79525	80480	T: hecfp128fkt
81081	83608	88465	T: ecfp256q
90694	91689	92844	T: gls254
104738	104739	104746	T: gls254prot
113410	114917	116103	T: gls1271
138541	138563	138579	T: k277taa
155609	155746	161545	T: kumfp127g
167168	167212	167362	T: k298
174711	174730	174763	T: curve25519
204601	204629	204667	T: kummer
211858	211870	211905	T: k277mon
254643	254723	256395	T: kumfp128g
341461	343121	345174	T: ecfp256i
366960	367256	367994	T: ed448goldilocks
375876	377590	379151	T: surf127eps
423492	427877	432411	T: sclaus1024
632720	633103	633417	T: nistp256
670940	673807	675667	T: surf2113
1837351	1838964	1843897	T: ed521gs
2102266	2119035	2138022	T: sclaus2048
2110041	2122080	2150117	T: nist521gs
2547143	2553838	2562927	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
85157	87074	87496	T: gls254
104657	104710	104710	T: gls254prot
138448	138450	138454	T: k277taa
160315	160332	160380	T: kumfp127g
161566	161806	162992	T: kumjacfp127g
167178	167207	167232	T: k298
186758	186780	186805	T: curve25519
197239	197262	197296	T: kummer
199385	199442	199554	T: jacfp128bk
211804	211805	211809	T: k277mon
241458	241958	242807	T: curve2251
247505	247849	248027	T: prjfp128bk
251825	251879	251979	T: hecfp128bk
263257	263454	263563	T: hecfp128fkt
264219	264395	264564	T: jacfp127i
266869	266950	267057	T: kumfp128g
273908	277064	281513	T: gls1271
320313	320423	320747	T: ecfp256e
335580	336201	337003	T: ecfp256q
338763	338927	339239	T: ecfp256i
357062	357242	357461	T: hecfp127i
359231	359349	359560	T: prjfp127i
373913	374164	379026	T: surf127eps
403004	403319	403801	T: ecfp256h
422663	422988	423410	T: ecfp256s
427272	428426	430504	T: sclaus1024
562251	562477	562600	T: hecfp128i
668065	671925	673795	T: surf2113
1158568	1158666	1158757	T: ed448goldilocks
1249605	1249617	1249753	T: nistp256
1834307	1839049	1844432	T: ed521gs
2098033	2101297	2131841	T: nist521gs
2108715	2117688	2120005	T: sclaus2048
2553685	2556544	2566788	T: claus

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1275 V2; 4 x 3500MHz; `hydra8`, `supercop-20211108`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
31995	33191	34393	T: jacfp127i
32509	33315	35003	T: kumjacfp127g
36066	38254	41045	T: prjfp127i
40716	41581	43420	T: jacfp128bk
40031	41649	43406	T: hecfp127i
50794	51809	53964	T: ecfp256e
51487	52245	53084	T: hecfp128fkt
50698	53249	55900	T: prjfp128bk
53618	54415	57117	T: ecfp256h
52529	55446	58125	T: hecfp128bk
54740	55803	57842	T: ecfp256s
55422	57317	58838	T: hecfp128i
57420	57920	61234	T: curve2251
58764	59942	62775	T: ecfp256q
73769	74724	76141	T: gls254
88751	88961	89056	T: kummer
96428	97478	98440	T: gls1271
106453	106511	106591	T: gls254prot
117024	117183	117270	T: kumfp127g
145032	145107	145429	T: curve25519
164999	165207	165344	T: kumfp128g
175113	176257	176369	T: k277taa
181230	181597	183233	T: k298
235217	235903	236531	T: surf127eps
242174	243251	244692	T: ecfp256i
257953	257955	257963	T: k277mon
266784	269074	271795	T: sclaus1024
312040	312347	313112	T: nistp256
655672	658945	660239	T: surf2113
1099219	1100408	1102521	T: ed521gs
1237280	1238912	1241388	T: nist521gs
1361536	1368532	1379654	T: sclaus2048
1599583	1603112	1606529	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
69578	72194	72546	T: gls254
88470	88638	88801	T: kummer
106292	106324	106375	T: gls254prot
119460	119589	119708	T: kumfp127g
124148	124266	124448	T: jacfp128bk
126536	126673	126829	T: kumjacfp127g
156716	156812	157249	T: curve25519
157900	158053	158286	T: prjfp128bk
162349	162462	162610	T: hecfp128bk
168485	168658	168841	T: hecfp128fkt
171050	171173	171299	T: kumfp128g
176001	176063	176126	T: k277taa
180884	180987	181073	T: k298
190532	190859	194843	T: jacfp127i
223138	224733	225025	T: curve2251
225093	225330	225573	T: ecfp256e
227263	228275	228920	T: surf127eps
235470	235656	235831	T: ecfp256q
238973	239168	239496	T: ecfp256i
239008	239407	240507	T: prjfp127i
235393	239533	241664	T: gls1271
244890	245206	245475	T: hecfp127i
257914	257917	257932	T: k277mon
272846	273288	276524	T: sclaus1024
275862	275927	276122	T: ecfp256h
297915	298065	298304	T: ecfp256s
365659	365890	366333	T: hecfp128i
653902	655593	657750	T: surf2113
770215	771170	771875	T: nistp256
1100817	1101846	1103443	T: ed521gs
1236277	1237619	1241012	T: nist521gs
1323848	1361676	1366685	T: sclaus2048
1596776	1598316	1600840	T: claus

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1265L V2; 4 x 2500MHz; `hedera`, `supercop-20210326`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
28909	29396	31004	T: jacfp127i
30070	30732	32520	T: kumjacfp127g
33819	34472	36539	T: hecfp127i
36486	37438	38776	T: prjfp127i
41201	42070	43565	T: jacfp128bk
48201	49198	50624	T: prjfp128bk
49217	50263	51237	T: hecfp128bk
49911	50717	51482	T: hecfp128fkt
49789	50753	51723	T: hecfp128i
50197	50808	51753	T: ecfp256e
53146	53791	55988	T: ecfp256h
56683	57098	59815	T: curve2251
57747	58279	59159	T: ecfp256s
58064	58899	61154	T: ecfp256q
74721	75804	76899	T: gls254
88697	88780	88991	T: kummer
96271	97485	99181	T: gls1271
106336	106406	106484	T: gls254prot
114137	114399	115068	T: kumfp127g
145078	145412	145504	T: curve25519
164848	164924	165097	T: kumfp128g
174548	175860	175937	T: k277taa
180998	181074	181254	T: k298
210970	211547	211882	T: ed448goldilocks
235920	236652	237958	T: surf127eps
242156	243312	244798	T: ecfp256i
257518	257522	257546	T: k277mon
265772	268328	270886	T: sclaus1024
291564	300634	312125	T: hector
319923	321152	322178	T: nistp256
578681	581128	582779	T: surf2113
1130495	1130900	1131611	T: ed521gs
1317678	1317847	1318914	T: nist521gs
1356204	1369352	1381427	T: sclaus2048
1594291	1596763	1600250	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
69962	70177	72435	T: gls254
88481	88569	88771	T: kummer
106240	106267	106320	T: gls254prot
116592	116673	116728	T: kumfp127g
124508	124588	124676	T: jacfp128bk
126848	126978	127086	T: kumjacfp127g
157341	157509	157688	T: prjfp128bk
156807	159451	160595	T: curve25519
161145	161262	161395	T: hecfp128bk
167278	167388	167502	T: hecfp128fkt
170626	170736	170839	T: kumfp128g
174307	175485	175560	T: k277taa
180306	180349	180412	T: k298
190558	190724	191176	T: jacfp127i
222999	223430	224790	T: curve2251
225426	225598	225763	T: ecfp256e
230305	230733	231179	T: surf127eps
234913	235082	235332	T: ecfp256q
234605	236070	239408	T: gls1271
238259	238493	238847	T: prjfp127i
238952	239103	239309	T: ecfp256i
244592	244829	245150	T: hecfp127i
257491	257500	257501	T: k277mon
268418	272793	274235	T: sclaus1024
276317	276426	276529	T: ecfp256h
297445	297545	297702	T: ecfp256s
365520	365678	365977	T: hecfp128i
579552	580206	580761	T: surf2113
628898	629615	631385	T: ed448goldilocks
765125	767126	769017	T: nistp256
996635	1034721	1045662	T: hector
1125008	1125449	1130459	T: ed521gs
1317314	1317449	1317705	T: nist521gs
1356801	1382093	1391271	T: sclaus2048
1594837	1595309	1596323	T: claus

amd64; SB+AES (206d7); 2012 Intel Xeon E5-2660; 8 x 2200MHz; unstable; `gcc123`, `supercop-20211108`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
31943	32708	33506	T: jacfp127i
32953	33765	35040	T: kumjacfp127g
37608	38623	39513	T: hecfp127i
39004	40504	42276	T: prjfp127i
45798	46604	49017	T: jacfp128bk
54528	55306	56314	T: ecfp256e
55935	57092	58739	T: prjfp128bk
56528	57439	58649	T: hecfp128fkt
57372	58038	60010	T: ecfp256h
58935	59355	62473	T: curve2251
58172	59686	61610	T: hecfp128i
57729	59694	61632	T: hecfp128bk
59213	60262	62540	T: ecfp256s
63294	64112	66013	T: ecfp256q
74267	75189	76426	T: gls254
89282	89333	89393	T: kummer
101621	102757	104070	T: gls1271
107786	107990	108100	T: gls254prot
120356	120660	120847	T: kumfp127g
147437	149335	150231	T: curve25519
176693	176754	176821	T: k277taa
183385	183523	183801	T: k298
183493	184494	184712	T: kumfp128g
216977	217416	218118	T: ed448goldilocks
258378	258897	259109	T: k277mon
264599	265793	267654	T: ecfp256i
271269	272151	273008	T: surf127eps
285659	288427	291181	T: sclaus1024
346611	347055	348467	T: nistp256
632059	635140	636537	T: surf2113
1201183	1202697	1213390	T: ed521gs
1437670	1438873	1440254	T: nist521gs
1453921	1463199	1474175	T: sclaus2048
1707624	1712069	1716365	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
68567	70640	70910	T: gls254
89053	89079	89114	T: kummer
107718	107843	108042	T: gls254prot
123422	123608	123778	T: kumfp127g
131022	131115	131347	T: kumjacfp127g
139870	140122	152456	T: jacfp128bk
158914	159113	159230	T: curve25519
176460	176503	176544	T: k277taa
178453	178678	178968	T: prjfp128bk
182177	182418	185208	T: hecfp128bk
182474	182579	182699	T: k298
189273	189532	200762	T: hecfp128fkt
190389	191431	191674	T: kumfp128g
200096	200414	213508	T: jacfp127i
231825	232605	232832	T: curve2251
248092	248254	248472	T: ecfp256e
249077	250480	251963	T: gls1271
257409	257555	257723	T: ecfp256q
258321	258857	259061	T: k277mon
260327	260627	261091	T: prjfp127i
261160	261279	261406	T: ecfp256i
264886	265400	269808	T: hecfp127i
267683	268185	269010	T: surf127eps
290366	291197	293939	T: sclaus1024
305106	305231	305409	T: ecfp256h
324559	324747	324996	T: ecfp256s
412908	413317	413695	T: hecfp128i
621379	623817	629240	T: surf2113
648753	651584	670955	T: ed448goldilocks
826719	827216	827670	T: nistp256
1207103	1210696	1213881	T: ed521gs
1437472	1438062	1439620	T: nist521gs
1444699	1466069	1478225	T: sclaus2048
1703400	1711775	1715637	T: claus

armeabi; Cortex-A9+NEON (412fc09a); 2011 Freescale i.MX6 Quad; 4 x 1200MHz; `novenablue`, `supercop-20200702`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
355418	355433	355453	kummer
567411	567423	567474	curve25519
1830608	1831928	1841365	nistp256
3530954	3571191	3610489	sclaus1024
16821840	16921770	17041862	sclaus2048
17108323	17116525	17123909	claus

Cycles to compute a shared secret
25%	50%	75%	system
355290	355292	355314	kummer
567279	567290	567304	curve25519
3589111	3605090	3620752	sclaus1024
6235333	6247947	6251411	nistp256
17073072	17079283	17089253	claus
17075724	17176722	17304846	sclaus2048

amd64; Bobcat (500f20); 2011 AMD E-450; 2 x 1650MHz; `h4e450`, `supercop-20200618`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
109449	111193	113002	ecfp256e
115891	118151	120825	ecfp256s
118252	120892	123514	ecfp256h
122422	124996	129290	ecfp256q
163504	165158	167077	gls1271
365223	365251	365807	curve25519
445930	447973	451468	ecfp256i
505970	507494	510150	curve2251
544483	545195	546701	ed448goldilocks
692774	700706	714319	sclaus1024
819556	820050	820462	nistp256
833093	833235	833644	kummer
2382657	2401724	2422462	ed521gs
2734466	2742750	2754734	nist521gs
3348479	3378798	3415136	sclaus2048
3929243	3958122	3983255	claus

Cycles to compute a shared secret
25%	50%	75%	system
365090	365104	365128	curve25519
397542	399228	400320	gls1271
414660	414894	415511	ecfp256e
434511	434777	435271	ecfp256q
443090	443298	443778	ecfp256i
524096	524333	525074	ecfp256h
526210	526509	527169	ecfp256s
718989	738801	748338	sclaus1024
832861	832880	833031	kummer
1579907	1580411	1601876	nistp256
1603206	1603372	1612269	ed448goldilocks
2100464	2101989	2120215	curve2251
2398997	2402844	2418305	ed521gs
2732779	2733008	2750526	nist521gs
3435509	3457193	3509623	sclaus2048
4014210	4035182	4051873	claus

amd64; K10 32nm (300f10); 2011 AMD A8-3850; 4 x 2900MHz; `hydra5`, `supercop-20191221`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
82847	84902	88097	ecfp256e
87308	88877	92391	ecfp256s
88305	90117	94256	ecfp256h
89533	91783	95523	ecfp256q
238724	238727	238732	curve25519
297083	299515	301840	sclaus1024
314702	315917	316595	surf127eps
321694	323675	325575	ecfp256i
337630	338108	340661	ed448goldilocks
472373	475992	476666	kummer
485674	486564	486599	nistp256
856497	860326	861353	surf2113
1026321	1030091	1031549	curve2251
1396888	1408394	1418637	sclaus2048
1674151	1674985	1679370	ed521gs
1767928	1771393	1777694	claus
2016811	2017409	2020821	nist521gs

Cycles to compute a shared secret
25%	50%	75%	system
239144	239148	239149	curve25519
291717	291739	291792	ecfp256e
298261	299226	302128	sclaus1024
302451	302815	302846	ecfp256q
308558	313577	313988	surf127eps
321335	321658	321699	ecfp256i
369854	369951	370023	ecfp256s
376309	376354	376389	ecfp256h
475200	475496	475854	kummer
847632	858269	858880	surf2113
1022249	1023254	1029254	curve2251
1030747	1031199	1031216	ed448goldilocks
1078770	1078774	1078778	nistp256
1391292	1427032	1430826	sclaus2048
1673398	1673930	1675583	ed521gs
1759706	1763423	1775993	claus
2015340	2016567	2017081	nist521gs

amd64; Atom (30661); 2011 Intel Atom D2500; 2 x 1866MHz; `h8atom`, `supercop-20200618`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
233016	235214	237797	ecfp256e
246855	247401	250768	curve2251
253099	256571	258552	ecfp256s
260533	262661	266770	ecfp256h
262738	265335	269241	ecfp256q
1096606	1096620	1097362	curve25519
1121071	1125180	1130094	surf127eps
1147811	1152326	1163400	ecfp256i
1321229	1322419	1326857	ed448goldilocks
1593984	1608705	1621592	surf2113
1750294	1750497	1766856	kummer
1738898	1757014	1774857	sclaus1024
1946014	1946546	1968519	nistp256
7100506	7100961	7108787	ed521gs
8478582	8479793	8493079	nist521gs
8654163	8731527	8809857	sclaus2048
10580290	10638012	10673810	claus

Cycles to compute a shared secret
25%	50%	75%	system
1008868	1009820	1012858	curve2251
1083313	1083411	1085161	ecfp256e
1096431	1096431	1096543	curve25519
1117067	1119587	1122534	surf127eps
1127630	1127763	1130241	ecfp256q
1152634	1152732	1154223	ecfp256i
1351378	1351490	1353226	ecfp256s
1437968	1438101	1439431	ecfp256h
1587852	1588342	1608544	surf2113
1750147	1750217	1750497	kummer
1750728	1757056	1773695	sclaus1024
3975881	3996972	3997700	nistp256
4505151	4522756	4523309	ed448goldilocks
7098224	7098427	7099652	ed521gs
8475985	8476559	8478393	nist521gs
8727446	8793232	8831109	sclaus2048
10639965	10666271	10687803	claus

amd64; Sandy Bridge (206a7); 2011 Intel Core i3-2310M; 2 x 2100MHz; `h6sandy`, `supercop-20200618`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
88768	90492	93372	ecfp256e
90076	94220	96448	ecfp256h
62592?	97464?	98308?	curve2251
62956?	97732?	100704?	ecfp256s
68272?	107684?	113584?	ecfp256q
129164	134368	136208	kummer
116456?	178476?	188488?	gls254
114376?	179180?	185012?	gls254prot
152712?	265100?	277808?	curve25519
265960	277836	288416	k277taa
182960?	282356?	290508?	k298
387580	399684	404956	ed448goldilocks
276600?	401388?	427304?	k277mon
267104?	409976?	423076?	ecfp256i
428868	440820	444448	surf127eps
519540	542096	565092	sclaus1024
755328	758404	764656	nistp256
1316776	1375216	1409380	surf2113
1267424?	2356904?	2415488?	ed521gs
2545784	2706344	2807096	sclaus2048
1537716?	2775536?	2828616?	nist521gs
2364472?	3205432?	3298160?	claus

Cycles to compute a shared secret
25%	50%	75%	system
129292	134356	136008	kummer
115276?	177420?	184452?	gls254
114396?	180260?	215364?	gls254prot
263516	279608	288208	k277taa
245364	282104	290140	k298
164676?	299076?	299896?	curve25519
355472	370724	378228	curve2251
256100?	395856?	424040?	ecfp256e
261228?	402868?	444592?	ecfp256i
389840	403848	427996	k277mon
423372	435000	437800	surf127eps
265028?	442068?	443916?	ecfp256q
308392?	467372?	506348?	ecfp256h
501068	518584	544828	ecfp256s
523836	560036	562760	sclaus1024
1142172	1185092	1206736	ed448goldilocks
1291468	1328268	1380048	surf2113
1535908	1627932	1633296	nistp256
2310408	2385676	2435704	ed521gs
2609648	2722984	2819684	sclaus2048
2354928	2800076	2865800	nist521gs
2542272?	3223840?	3282100?	claus

amd64; C2 45nm (10676); 2007 Intel Xeon X5450; 8 x 2992MHz; unstable; `gcc14`, `supercop-20211108`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
45073	47463	50135	T: jacfp127i
47041	48352	49377	T: kumjacfp127g
51723	53951	57038	T: prjfp127i
53002	55177	59391	T: hecfp127i
71369	72558	76668	T: ecfp256e
77419	78996	84435	T: ecfp256h
78095	79351	80571	T: jacfp128bk
79688	81591	86347	T: ecfp256s
88494	89081	91698	T: ecfp256q
89987	92678	95313	T: prjfp128bk
90695	93092	96851	T: hecfp128fkt
91464	93688	97172	T: hecfp128i
91884	93931	96811	T: hecfp128bk
122081	124406	126622	T: gls1271
127352	128298	131045	T: curve2251
178621	178639	178774	T: kumfp127g
299212	299279	299300	T: curve25519
314856	315067	315465	T: kumfp128g
329748	330281	330858	T: ed448goldilocks
384083	386835	388905	T: ecfp256i
413326	415894	420963	T: surf127eps
422448	422696	424925	T: kummer
422389	426879	430417	T: sclaus1024
592353	599624	599809	T: nistp256
703975	707187	707993	T: surf2113
1651276	1654847	1665749	T: ed521gs
1965828	1968124	1970593	T: nist521gs
2141649	2158462	2174320	T: sclaus2048
2531594	2536774	2542306	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
183308	183339	183401	T: kumfp127g
187644	188022	188184	T: kumjacfp127g
244882	244967	245135	T: jacfp128bk
292653	292810	292871	T: jacfp127i
298596	298922	299590	T: curve25519
301634	301818	301972	T: prjfp128bk
307377	307524	307663	T: hecfp128bk
315724	316398	332895	T: gls1271
318241	318313	318421	T: hecfp128fkt
327094	327144	327284	T: kumfp128g
362120	362446	362793	T: ecfp256e
377991	378292	378707	T: ecfp256q
381459	381554	381707	T: prjfp127i
383653	383881	384037	T: ecfp256i
388709	388774	388844	T: hecfp127i
412903	415509	419428	T: surf127eps
422428	422854	424362	T: kummer
424342	428316	440575	T: sclaus1024
455103	455540	455801	T: ecfp256h
470134	470272	470478	T: ecfp256s
519804	523960	528188	T: curve2251
694179	694320	694727	T: hecfp128i
701889	703404	704125	T: surf2113
1022552	1023096	1026174	T: ed448goldilocks
1175789	1175997	1177498	T: nistp256
1650753	1654641	1665087	T: ed521gs
1965264	1967089	1969059	T: nist521gs
2127175	2145573	2206421	T: sclaus2048
2537381	2538852	2573470	T: claus

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2404MHz; `margaux`, `supercop-20211108`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
41887	42996	44689	T: jacfp127i
43865	45175	46455	T: kumjacfp127g
48026	49318	51701	T: prjfp127i
49919	51679	54236	T: hecfp127i
74958	76222	77368	T: jacfp128bk
77485	78207	79759	T: ecfp256e
82863	83458	85025	T: ecfp256h
84051	84917	86249	T: ecfp256s
87981	89312	90934	T: prjfp128bk
88430	90552	93172	T: hecfp128bk
88974	90570	93427	T: hecfp128i
89199	90771	93712	T: hecfp128fkt
90493	91525	93049	T: ecfp256q
126201	127832	129176	T: gls1271
131760	132846	135609	T: curve2251
178795	178878	178985	T: kumfp127g
300192	301403	302425	T: curve25519
314730	314938	315180	T: kumfp128g
345050	345724	346796	T: ed448goldilocks
387780	389344	391450	T: ecfp256i
421852	426405	430360	T: sclaus1024
428379	430954	431872	T: kummer
430610	432379	433903	T: surf127eps
493841	495056	497115	T: nistp256
707495	711520	713861	T: surf2113
1684659	1686784	1690900	T: ed521gs
1961216	1964124	1966514	T: nist521gs
2150568	2169713	2186433	T: sclaus2048
2543920	2551253	2590229	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
183326	183367	183534	T: kumfp127g
187766	188158	188287	T: kumjacfp127g
243799	243974	244147	T: jacfp128bk
292249	292381	292659	T: jacfp127i
300639	301514	302074	T: curve25519
301871	301937	302075	T: prjfp128bk
307782	307874	308088	T: hecfp128bk
314737	317098	322188	T: gls1271
318275	318491	318792	T: hecfp128fkt
327017	327159	327324	T: kumfp128g
366127	366434	366882	T: ecfp256e
381376	381552	381748	T: prjfp127i
382271	382569	383032	T: ecfp256q
387243	387400	387571	T: ecfp256i
389428	389624	390460	T: hecfp127i
421353	423825	442261	T: sclaus1024
427824	429971	431287	T: kummer
427793	430637	431718	T: surf127eps
458397	458634	458912	T: ecfp256h
474824	475181	475579	T: ecfp256s
545868	547486	551403	T: curve2251
693928	694211	694565	T: hecfp128i
699997	709759	711290	T: surf2113
1029159	1030521	1031363	T: ed448goldilocks
1160333	1161107	1162255	T: nistp256
1683664	1685725	1687535	T: ed521gs
1959610	1962117	1967104	T: nist521gs
2170203	2174419	2183777	T: sclaus2048
2526743	2546676	2604215	T: claus

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2394MHz; `latour`, `supercop-20201130`

Graphs: old (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
41814	42840	44001	T: jacfp127i
43614	44676	46188	T: kumjacfp127g
48816	49797	51165	T: prjfp127i
49536	51093	53487	T: hecfp127i
74205	75240	76527	T: jacfp128bk
76086	76797	78336	T: ecfp256e
81711	82269	83826	T: ecfp256h
83106	84024	85320	T: ecfp256s
87480	88587	90063	T: prjfp128bk
88011	89730	92655	T: hecfp128bk
88074	89739	92124	T: hecfp128i
89172	90090	91323	T: ecfp256q
88695	90423	92889	T: hecfp128fkt
131796	132273	134325	T: curve2251
178803	178830	179568	T: kumfp127g
296073	296397	297711	T: curve25519
315045	315459	316053	T: kumfp128g
329778	330426	331290	T: ed448goldilocks
386811	388890	392112	T: ecfp256i
413433	415692	419049	T: surf127eps
423441	423486	423549	T: kummer
423990	428571	432324	T: sclaus1024
592785	600993	602676	T: nistp256
751266	755028	756891	T: surf2113
1655343	1657602	1663704	T: ed521gs
1998747	2002014	2011401	T: nist521gs
2160747	2175453	2191986	T: sclaus2048
2543508	2550222	2559150	T: claus

Cycles to compute a shared secret
25%	50%	75%	system
183384	183411	183411	T: kumfp127g
188046	188361	188451	T: kumjacfp127g
243351	243567	243639	T: jacfp128bk
292230	292473	292662	T: jacfp127i
296640	297639	297720	T: curve25519
299241	299403	300294	T: prjfp128bk
307611	307755	307872	T: hecfp128bk
318600	318717	318897	T: hecfp128fkt
327852	328167	328644	T: kumfp128g
367776	368136	368640	T: ecfp256e
380538	380673	380880	T: prjfp127i
381825	382068	382302	T: ecfp256q
386514	386766	387054	T: ecfp256i
389520	389556	389691	T: hecfp127i
411264	413793	416106	T: surf127eps
423396	423423	423504	T: kummer
429975	433134	438012	T: sclaus1024
459072	459234	459450	T: ecfp256h
474966	475245	475497	T: ecfp256s
548262	550845	555012	T: curve2251
694503	694620	694746	T: hecfp128i
748431	751878	753390	T: surf2113
1019178	1024416	1029906	T: ed448goldilocks
1173393	1173609	1173906	T: nistp256
1650006	1650942	1658637	T: ed521gs
1998486	2000583	2010285	T: nist521gs
2196918	2209878	2213046	T: sclaus2048
2544885	2550501	2563587	T: claus

ppc32; G3 (G3); 2006 IBM PowerPC Broadway; 1 x 729MHz; `nintendowiilinuxngx`, `supercop-20191221`

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%	50%	75%	system
1547592	1552668	1558584	kummer
2635428	2646276	2734368	nistp256
3368832	3374820	3460836	curve25519
42407448	44419716	44586084	claus

Cycles to compute a shared secret
25%	50%	75%	system
1605696	1609332	1614516	kummer
3381888	3387060	3478356	curve25519
8636760?	10661148?	12581784?	nistp256
42365712	44352564	44515572	claus

Version

This is version 2021.11.27 of the results-dh.html web page. This web page is in the public domain.

eBACS: ECRYPT Benchmarking of Cryptographic Systems

Measurements of public-key Diffie–Hellman secret-sharing systems, indexed by machine

Sizes across machines

aarch64; Firestorm (610f0230); 2020 Apple M1; 4 x 3200MHz; unstable; minimac, supercop-20211108

amd64; TigerLake (806c1); 2020 Intel Core i7-1165G7; 4 x 2800MHz; unstable; pascalinspiron75062n1, supercop-20210125

amd64; IceLake (706e5); 2020 Intel Core i5-1030NG7; 4 x 1100MHz; icelake, supercop-20200826

aarch64; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; pi4b, supercop-20211108

aarch64; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; rpi4ubuntu64, supercop-20191221

armeabi; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; rpi4, supercop-20191221

ppc64; POWER9 (004e1203); 2019? IBM 02CY642; 22 x 3800MHz; power9, supercop-20210326

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; colossus6, supercop-20210125

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; colossus7, supercop-20210125

amd64; Zen (810f81); 2019 AMD Ryzen Embedded R1606G; 2 x 2600MHz; unstable; ghf51, supercop-20200702

amd64; CometLake (806ec); 2019 Intel Core i3-10110U; 2 x 2100MHz; comet, supercop-20211108

amd64; CascadeLake (50657); 2019 Intel Xeon Gold 6230; 40 x 2100MHz; unstable; cel02, supercop-20201130

amd64; CascadeLake (50657); 2019 Intel Xeon Gold 6230; 40 x 2100MHz; unstable; ygritte, supercop-20200525

amd64; CascadeLake (50657); 2019 Intel Core i9-10980XE; 18 x 3000MHz; avx512imath, supercop-20210125

aarch64; Skylark (503f0002); 2018 Ampere eMAG 8180; 32 x 3300MHz; gcc185, supercop-20211108

aarch64; A53+crypto (410fd034); 2018 NXP i.MX 8M; 4 x 1500MHz; googlecoraldev, supercop-20191221

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; pi3aplus, supercop-20211108

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; pi3bplus, supercop-20210604

amd64; Zen (810f10); 2018 AMD Ryzen 5 2400G; 4 x 3600MHz; unstable; gcc67, supercop-20210125

amd64; Zen+ (800f82); 2018 AMD Ryzen 7 2700; 8 x 3200MHz; unstable; gcc68, supercop-20191221

amd64; CoffeeLake (906ea); 2018 Intel Xeon E-2124; 4 x 3300MHz; r24000, supercop-20211108

amd64; KabyLake (906e9); 2018 Intel Core i7-8705G; 4 x 3100MHz; unstable; sectionthirtyone, supercop-20191221

aarch64; A53+crypto (410fd034); 2017 Rockchip RK3328; 4 x 1512MHz; renegaderocrk3328cc, supercop-20191221

aarch64; A53+crypto (410fd034); 2017 HiSilicon Kirin 970; 8 x 1844MHz; unstable; hikey970, supercop-20191221

riscv64; U54 (sifive,u54-mc); 2017 SiFive Freedom U540; 4 x 1400MHz; hifiveunleashedriscv, supercop-20191221

riscv64; U54 (sifive,u54-mc); 2017 SiFive Freedom U540; 4 x 1000MHz; riscvunleashed000, supercop-20210326

amd64; Zen (800f12); 2017 AMD EPYC 7501; 32 x 2000MHz; unstable; colossus5, supercop-20210125

amd64; Zen (800f12); 2017 AMD EPYC 7451; 48 x 2300MHz; unstable; firefly, supercop-20201130

amd64; Zen (800f11); 2017 AMD Ryzen 7 1700; 8 x 3000MHz; rumba7, supercop-20211108

amd64; Zen (800f11); 2017 AMD Ryzen 5 1600; 6 x 3200MHz; rumba5, supercop-20211108

amd64; Zen (800f11); 2017 AMD Ryzen 3 1200; 4 x 3100MHz; rumba3, supercop-20200906

amd64; KabyLake (906e9); 2017 Intel Xeon E3-1220 v6; 4 x 3000MHz; kizomba, supercop-20211108

amd64; KabyLake (806e9); 2017 Intel Core i7-7567U; 2 x 3500MHz; unstable; intelnuci7, supercop-20211108

aarch64; A57+crypto (411fd072); 2016 AMD Opteron A1100; 8 x 2000MHz; warbear0, supercop-20200826

aarch64; A53+crypto (410fd034); 2016 HiSilicon Kirin 960; 8 x 1844MHz; unstable; hikey960spare, supercop-20191221

aarch64; A53+crypto (410fd034); 2016 Amlogic S905X; 4 x 1512MHz; lepotatoamls905xcc, supercop-20191221

armeabi; A53 (410fd034); 2016 Broadcom BCM2837; 4 x 1200MHz; unstable; rpi3b, supercop-20191221

armeabi; Cortex-A7 (410fc075); 2016 Broadcom BCM2836; 4 x 900MHz; berry2, supercop-20210604

amd64; BW+AES (406f1); 2016 Intel Xeon E5-2609 v4; 8 x 1700MHz; bolero, supercop-20211108

aarch64; A53+crypto (410fd034); 2015 NXP QorIQ LS1088; 8 x 1600MHz; ten64, supercop-20210604

amd64; Skylake (506e3); 2015 Intel Xeon E3-1220 v5; 4 x 3000MHz; samba, supercop-20211108

amd64; BW+AES (306d4); 2015 Intel Core i5-5350U; 2 x 1800MHz; unstable; luft, supercop-20200702

armeabi; Cortex-A17 (410fc0d1); 2014 Rockchip RK3288; 4 x 1800MHz; unstable; tinkerboards, supercop-20191221

armeabi; Cortex-A17 (410fc0d1); 2014 Rockchip RK3288; 4 x 1512MHz; unstable; tinkerboard, supercop-20191221

amd64; HW+AES (306f2); 2014 Intel Xeon E5-1630 v3; 4 x 3700MHz; unstable; wyvern1, supercop-20191221

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1275 V3; 4 x 3500MHz; titan0, supercop-20211108

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1220 v3; 4 x 3100MHz; hiphop, supercop-20211108

armeabi; Cortex-A9+NEON (413fc090); 2012 Samsung Exynos 4412?; 4 x 1200MHz; artik, supercop-20191221

amd64; Piledriver (610f01); 2012 AMD A10-4655M; 2 x 2000MHz; h9trinity, supercop-20200618

amd64; Bulldozer (600f20); 2012 AMD FX-8350; 4 x 4000MHz; saber214, supercop-20211108

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1275 V2; 4 x 3500MHz; hydra8, supercop-20211108

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1265L V2; 4 x 2500MHz; hedera, supercop-20210326

amd64; SB+AES (206d7); 2012 Intel Xeon E5-2660; 8 x 2200MHz; unstable; gcc123, supercop-20211108

armeabi; Cortex-A9+NEON (412fc09a); 2011 Freescale i.MX6 Quad; 4 x 1200MHz; novenablue, supercop-20200702

amd64; Bobcat (500f20); 2011 AMD E-450; 2 x 1650MHz; h4e450, supercop-20200618

amd64; K10 32nm (300f10); 2011 AMD A8-3850; 4 x 2900MHz; hydra5, supercop-20191221

amd64; Atom (30661); 2011 Intel Atom D2500; 2 x 1866MHz; h8atom, supercop-20200618

amd64; Sandy Bridge (206a7); 2011 Intel Core i3-2310M; 2 x 2100MHz; h6sandy, supercop-20200618

amd64; C2 45nm (10676); 2007 Intel Xeon X5450; 8 x 2992MHz; unstable; gcc14, supercop-20211108

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2404MHz; margaux, supercop-20211108

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2394MHz; latour, supercop-20201130

ppc32; G3 (G3); 2006 IBM PowerPC Broadway; 1 x 729MHz; nintendowiilinuxngx, supercop-20191221

Version

aarch64; Firestorm (610f0230); 2020 Apple M1; 4 x 3200MHz; unstable; `minimac`, `supercop-20211108`

amd64; TigerLake (806c1); 2020 Intel Core i7-1165G7; 4 x 2800MHz; unstable; `pascalinspiron75062n1`, `supercop-20210125`

amd64; IceLake (706e5); 2020 Intel Core i5-1030NG7; 4 x 1100MHz; `icelake`, `supercop-20200826`

aarch64; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; `pi4b`, `supercop-20211108`

aarch64; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; `rpi4ubuntu64`, `supercop-20191221`

armeabi; A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; `rpi4`, `supercop-20191221`

ppc64; POWER9 (004e1203); 2019? IBM 02CY642; 22 x 3800MHz; `power9`, `supercop-20210326`

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; `colossus6`, `supercop-20210125`

amd64; Zen2 (830f10); 2019 AMD EPYC 7742; 64 x 2250MHz; unstable; `colossus7`, `supercop-20210125`

amd64; Zen (810f81); 2019 AMD Ryzen Embedded R1606G; 2 x 2600MHz; unstable; `ghf51`, `supercop-20200702`

amd64; CometLake (806ec); 2019 Intel Core i3-10110U; 2 x 2100MHz; `comet`, `supercop-20211108`

amd64; CascadeLake (50657); 2019 Intel Xeon Gold 6230; 40 x 2100MHz; unstable; `cel02`, `supercop-20201130`

amd64; CascadeLake (50657); 2019 Intel Xeon Gold 6230; 40 x 2100MHz; unstable; `ygritte`, `supercop-20200525`

amd64; CascadeLake (50657); 2019 Intel Core i9-10980XE; 18 x 3000MHz; `avx512imath`, `supercop-20210125`

aarch64; Skylark (503f0002); 2018 Ampere eMAG 8180; 32 x 3300MHz; `gcc185`, `supercop-20211108`

aarch64; A53+crypto (410fd034); 2018 NXP i.MX 8M; 4 x 1500MHz; `googlecoraldev`, `supercop-20191221`

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; `pi3aplus`, `supercop-20211108`

aarch64; A53 (410fd034); 2018 Broadcom BCM2837B0; 4 x 1400MHz; `pi3bplus`, `supercop-20210604`

amd64; Zen (810f10); 2018 AMD Ryzen 5 2400G; 4 x 3600MHz; unstable; `gcc67`, `supercop-20210125`

amd64; Zen+ (800f82); 2018 AMD Ryzen 7 2700; 8 x 3200MHz; unstable; `gcc68`, `supercop-20191221`

amd64; CoffeeLake (906ea); 2018 Intel Xeon E-2124; 4 x 3300MHz; `r24000`, `supercop-20211108`

amd64; KabyLake (906e9); 2018 Intel Core i7-8705G; 4 x 3100MHz; unstable; `sectionthirtyone`, `supercop-20191221`

aarch64; A53+crypto (410fd034); 2017 Rockchip RK3328; 4 x 1512MHz; `renegaderocrk3328cc`, `supercop-20191221`

aarch64; A53+crypto (410fd034); 2017 HiSilicon Kirin 970; 8 x 1844MHz; unstable; `hikey970`, `supercop-20191221`

riscv64; U54 (sifive,u54-mc); 2017 SiFive Freedom U540; 4 x 1400MHz; `hifiveunleashedriscv`, `supercop-20191221`

riscv64; U54 (sifive,u54-mc); 2017 SiFive Freedom U540; 4 x 1000MHz; `riscvunleashed000`, `supercop-20210326`

amd64; Zen (800f12); 2017 AMD EPYC 7501; 32 x 2000MHz; unstable; `colossus5`, `supercop-20210125`

amd64; Zen (800f12); 2017 AMD EPYC 7451; 48 x 2300MHz; unstable; `firefly`, `supercop-20201130`

amd64; Zen (800f11); 2017 AMD Ryzen 7 1700; 8 x 3000MHz; `rumba7`, `supercop-20211108`

amd64; Zen (800f11); 2017 AMD Ryzen 5 1600; 6 x 3200MHz; `rumba5`, `supercop-20211108`

amd64; Zen (800f11); 2017 AMD Ryzen 3 1200; 4 x 3100MHz; `rumba3`, `supercop-20200906`

amd64; KabyLake (906e9); 2017 Intel Xeon E3-1220 v6; 4 x 3000MHz; `kizomba`, `supercop-20211108`

amd64; KabyLake (806e9); 2017 Intel Core i7-7567U; 2 x 3500MHz; unstable; `intelnuci7`, `supercop-20211108`

aarch64; A57+crypto (411fd072); 2016 AMD Opteron A1100; 8 x 2000MHz; `warbear0`, `supercop-20200826`

aarch64; A53+crypto (410fd034); 2016 HiSilicon Kirin 960; 8 x 1844MHz; unstable; `hikey960spare`, `supercop-20191221`

aarch64; A53+crypto (410fd034); 2016 Amlogic S905X; 4 x 1512MHz; `lepotatoamls905xcc`, `supercop-20191221`

armeabi; A53 (410fd034); 2016 Broadcom BCM2837; 4 x 1200MHz; unstable; `rpi3b`, `supercop-20191221`

armeabi; Cortex-A7 (410fc075); 2016 Broadcom BCM2836; 4 x 900MHz; `berry2`, `supercop-20210604`

amd64; BW+AES (406f1); 2016 Intel Xeon E5-2609 v4; 8 x 1700MHz; `bolero`, `supercop-20211108`

aarch64; A53+crypto (410fd034); 2015 NXP QorIQ LS1088; 8 x 1600MHz; `ten64`, `supercop-20210604`

amd64; Skylake (506e3); 2015 Intel Xeon E3-1220 v5; 4 x 3000MHz; `samba`, `supercop-20211108`

amd64; BW+AES (306d4); 2015 Intel Core i5-5350U; 2 x 1800MHz; unstable; `luft`, `supercop-20200702`

armeabi; Cortex-A17 (410fc0d1); 2014 Rockchip RK3288; 4 x 1800MHz; unstable; `tinkerboards`, `supercop-20191221`

armeabi; Cortex-A17 (410fc0d1); 2014 Rockchip RK3288; 4 x 1512MHz; unstable; `tinkerboard`, `supercop-20191221`

amd64; HW+AES (306f2); 2014 Intel Xeon E5-1630 v3; 4 x 3700MHz; unstable; `wyvern1`, `supercop-20191221`

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1275 V3; 4 x 3500MHz; `titan0`, `supercop-20211108`

amd64; HW+AES (306c3); 2013 Intel Xeon E3-1220 v3; 4 x 3100MHz; `hiphop`, `supercop-20211108`

armeabi; Cortex-A9+NEON (413fc090); 2012 Samsung Exynos 4412?; 4 x 1200MHz; `artik`, `supercop-20191221`

amd64; Piledriver (610f01); 2012 AMD A10-4655M; 2 x 2000MHz; `h9trinity`, `supercop-20200618`

amd64; Bulldozer (600f20); 2012 AMD FX-8350; 4 x 4000MHz; `saber214`, `supercop-20211108`

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1275 V2; 4 x 3500MHz; `hydra8`, `supercop-20211108`

amd64; IB+AES (306a9); 2012 Intel Xeon E3-1265L V2; 4 x 2500MHz; `hedera`, `supercop-20210326`

amd64; SB+AES (206d7); 2012 Intel Xeon E5-2660; 8 x 2200MHz; unstable; `gcc123`, `supercop-20211108`

armeabi; Cortex-A9+NEON (412fc09a); 2011 Freescale i.MX6 Quad; 4 x 1200MHz; `novenablue`, `supercop-20200702`

amd64; Bobcat (500f20); 2011 AMD E-450; 2 x 1650MHz; `h4e450`, `supercop-20200618`

amd64; K10 32nm (300f10); 2011 AMD A8-3850; 4 x 2900MHz; `hydra5`, `supercop-20191221`

amd64; Atom (30661); 2011 Intel Atom D2500; 2 x 1866MHz; `h8atom`, `supercop-20200618`

amd64; Sandy Bridge (206a7); 2011 Intel Core i3-2310M; 2 x 2100MHz; `h6sandy`, `supercop-20200618`

amd64; C2 45nm (10676); 2007 Intel Xeon X5450; 8 x 2992MHz; unstable; `gcc14`, `supercop-20211108`

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2404MHz; `margaux`, `supercop-20211108`

amd64; C2 65nm (6fb); 2007 Intel Core 2 Quad Q6600; 4 x 2394MHz; `latour`, `supercop-20201130`

ppc32; G3 (G3); 2006 IBM PowerPC Broadway; 1 x 729MHz; `nintendowiilinuxngx`, `supercop-20191221`