VAMPIRE

eBACS: ECRYPT Benchmarking of Cryptographic Systems

ECRYPT II

Measurements of public-key Diffie–Hellman secret-sharing systems, indexed by machine

There is a separate page with more information about each Diffie–Hellman system and each implementation. Designers and implementors interested in submitting new Diffie–Hellman systems and new implementations of existing systems should read the call for submissions.

What do the graphs and tables mean?

• Time to compute a shared secret, given one user's secret key and another user's public key.
• Time to compute a key pair.
• Space for a secret key.
• Space for a public key.
• Space for a shared secret.

Each computer also has a series of tables, five tables for each computer. The first table shows the time, in cycles, to generate a key pair. Each row of the table lists

• the first quartile of many time measurements,
• the median of many time measurements,
• the third quartile of many time measurements, and
• the name of the secret-sharing systems.

The computer name is linked to additional information about the implementations and compilers selected for benchmarking.

amd64; Zen (800f12); 2017 AMD EPYC 7601; 64 x 2200MHz; unstable; genji262, supercop-20180818

Cycles to generate a key pair quartile median quartile system 25762 27236 29788 jacfp127i 29194 30338 32142 hecfp127i 27874 31064 34452 kumjacfp127g 29612 31966 35838 prjfp127i 32934 34364 36608 jacfp128bk 34100 34958 37136 curve2251 32890 35134 38940 ecfp256e 39072 39138 39402 gls254prot 38588 39468 40524 hecfp128i 38654 39534 40942 hecfp128bk 37818 40106 44022 ecfp256s 38126 40260 44814 hecfp128fkt 38764 40678 41074 gls254 41272 41756 43230 ecfp256h 38852 41800 45782 ecfp256q 40062 42306 45254 prjfp128bk 50270 50952 51018 k277taa 55242 55792 56562 gls1271 61776 62898 68640 k298 76318 76626 77330 k277mon 86658 88286 88352 kumfp127g 92290 93544 95678 kummer 111892 112860 113058 kumfp128g 118382 119504 122980 curve25519 152548 154330 156684 ecfp256i 158114 159368 163438 surf127eps 178002 178882 181236 ed448goldilocks 196812 199364 202598 sclaus1024 267674 268378 270248 nistp256 432498 434984 451440 surf2113 789756 803176 820732 hector 826166 843898 863346 ed521gs 968066 986172 1007996 nist521gs 997436 1013144 1032372 sclaus2048 1127896 1145672 1176626 claus Cycles to compute a shared secret quartile median quartile system 37400 38500 38896 gls254 39006 39072 39336 gls254prot 50226 50578 50754 k277taa 60566 62172 62788 k298 76252 76890 77022 k277mon 88440 88506 89166 kumjacfp127g 88858 90508 90684 kumfp127g 92092 93764 95062 kummer 98538 98912 99660 jacfp128bk 116226 116490 117106 prjfp128bk 117326 118382 119482 kumfp128g 118624 119724 120868 hecfp128bk 120428 121264 124586 hecfp128fkt 129316 130570 133804 curve25519 131098 134002 134772 curve2251 133540 136598 140800 gls1271 140668 143176 144496 jacfp127i 141922 146608 147532 ecfp256e 149820 150832 152438 ecfp256i 152240 153054 156156 surf127eps 150150 153120 154814 ecfp256q 175208 176990 180224 prjfp127i 180576 182248 184778 hecfp127i 185878 186252 189684 ecfp256h 196350 196526 198352 ecfp256s 200750 202400 203258 sclaus1024 241252 243254 245718 hecfp128i 433774 434698 449306 surf2113 542806 549494 562958 ed448goldilocks 698654 705738 720874 nistp256 824802 841236 858814 ed521gs 968132 985798 1003904 nist521gs 980100 1017786 1037234 sclaus2048 1119228 1140282 1173304 claus 2741442 2761506 2795144 hector Secret key bytes system 20 sclaus1024 28 sclaus2048 28 surf2113 29 hector 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 32 hecfp127i 32 hecfp128bk 32 hecfp128fkt 32 hecfp128i 32 jacfp127i 32 jacfp128bk 32 k298 32 kumfp127g 32 kumfp128g 32 kumjacfp127g 32 kummer 32 nistp256 32 prjfp127i 32 prjfp128bk 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 32 gls1271 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 48 surf127eps 48 surf2113 56 ed448goldilocks 60 hector 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 48 surf127eps 48 surf2113 60 hector 64 ed448goldilocks 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; Zen (800f11); 2017 AMD Ryzen 7 1700; 8 x 3000MHz; rumba7, supercop-20171218

Cycles to generate a key pair quartile median quartile system 37950 39120 41820 ecfp256e 42210 42930 46110 curve2251 40890 43110 47520 ecfp256h 43230 44100 45060 gls254 42720 44550 48660 ecfp256s 45630 46080 46170 gls254prot 44610 46680 51360 ecfp256q 56280 56340 56370 k277taa 73950 74040 74250 k298 73680 74520 75360 gls1271 85380 85770 86280 k277mon 91860 92250 92310 kummer 147030 147240 147360 curve25519 176640 177360 178740 ecfp256i 197850 198660 199230 surf127eps 207810 208170 208680 ed448goldilocks 222240 224370 226230 sclaus1024 367050 368460 368760 nistp256 537870 539910 541020 surf2113 986250 990720 993900 ed521gs 1116030 1123830 1130880 sclaus2048 1189050 1191900 1296990 nist521gs 1290510 1291650 1293540 claus Cycles to compute a shared secret quartile median quartile system 38100 38580 39360 gls254 45540 45600 46050 gls254prot 56280 56340 56370 k277taa 73890 73950 74040 k298 85260 85950 86250 k277mon 92220 92400 93300 kummer 157260 157500 158010 curve2251 157380 157530 157620 curve25519 168060 168120 168300 ecfp256e 175200 175350 175620 ecfp256i 176310 176580 176700 ecfp256q 176310 177480 179880 gls1271 192030 192330 192540 surf127eps 207900 208020 208440 ecfp256h 219900 222270 224550 sclaus1024 226260 226350 226470 ecfp256s 527160 533070 540990 surf2113 612570 612870 617220 ed448goldilocks 681240 681420 681510 nistp256 989340 992460 999210 ed521gs 1115190 1117860 1143330 sclaus2048 1187130 1191660 1299540 nist521gs 1283430 1285110 1286100 claus Secret key bytes system 20 sclaus1024 28 sclaus2048 28 surf2113 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 32 gls1271 48 kummer 48 surf127eps 48 surf2113 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 48 surf2113 64 ed448goldilocks 64 gls254 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

x86; normally amd64; Zen (800f11); 2017 AMD Ryzen 7 1700; 8 x 3000MHz; rumba7, supercop-20171218

Cycles to generate a key pair quartile median quartile system 118650 119460 119850 k277mon 585720 588060 589860 kummer 657690 657750 657930 curve25519 660840 663270 665010 nistp256 1109940 1112820 1115880 ed448goldilocks Cycles to compute a shared secret quartile median quartile system 118650 119730 121470 k277mon 584760 585480 588630 kummer 656940 657150 658590 curve25519 2235210 2240250 2244840 nistp256 3628410 3630510 3639210 ed448goldilocks Secret key bytes system 32 curve25519 32 kummer 32 nistp256 48 k277mon 144 ed448goldilocks Public key bytes system 32 curve25519 48 kummer 56 ed448goldilocks 64 nistp256 80 k277mon Shared secret bytes system 32 curve25519 40 k277mon 48 kummer 64 ed448goldilocks 64 nistp256

amd64; Zen (800f11); 2017 AMD Ryzen 7 1700; 8 x 2994MHz; ryzen, supercop-20170904

Cycles to generate a key pair quartile median quartile system 38670 39210 41190 curve2251 44550 44760 45120 gls254 46080 46290 46350 gls254prot 64230 64260 64290 k277taa 66510 66630 66840 k298 82830 82950 82980 k277mon 103350 103410 103470 kummer 135510 135510 135540 curve25519 203070 205320 207660 surf127eps 213870 214020 214350 ed448goldilocks 350430 351060 351420 nistp256 1388910 1390620 1392090 ed521gs 1663530 1665720 1669350 nist521gs Cycles to compute a shared secret quartile median quartile system 43440 43470 43500 gls254 46050 46110 46230 gls254prot 64170 64200 64200 k277taa 66360 66390 66480 k298 82020 82140 82170 k277mon 103320 103380 103440 kummer 146910 147480 148890 curve25519 150270 150750 151290 curve2251 199290 200820 202980 surf127eps 540660 541860 542520 ed448goldilocks 623790 624300 624660 nistp256 1387410 1389660 1391250 ed521gs 1664850 1667730 1671570 nist521gs Secret key bytes system 32 curve2251 32 curve25519 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 56 ed448goldilocks 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 k298 144 ed521gs 144 nist521gs Shared secret bytes system 32 curve2251 32 curve25519 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs

amd64; Zen (800f11); 2017 AMD Ryzen 5 1600; 6 x 3200MHz; rumba5, supercop-20181113

Cycles to generate a key pair quartile median quartile system 38688 40096 43232 ecfp256e 42624 43616 47776 curve2251 41600 44192 49440 ecfp256h 42944 44896 50208 ecfp256s 44192 44896 45696 gls254 46368 46656 47168 gls254prot 45408 47872 53088 ecfp256q 56576 56672 57376 k277taa 74208 74336 74656 k298 85600 85792 86688 k277mon 85408 86496 86976 gls1271 92672 92832 93888 kummer 144544 144576 145152 curve25519 177312 178208 179296 ecfp256i 198560 199200 199776 surf127eps 209216 209696 210432 ed448goldilocks 222912 224896 227328 sclaus1024 251424 255552 271104 hector 367744 367904 368160 nistp256 540128 542432 543328 surf2113 993664 996128 999968 ed521gs 1117568 1124096 1133248 sclaus2048 1190496 1191904 1193664 nist521gs 1295424 1296672 1299008 claus Cycles to compute a shared secret quartile median quartile system 38272 38656 39360 gls254 45984 46176 46528 gls254prot 56384 56512 57504 k277taa 73984 74112 74240 k298 85568 85760 86368 k277mon 92576 92704 93728 kummer 158048 158272 158912 curve25519 156864 158560 158848 curve2251 168928 169056 169184 ecfp256e 175808 175936 176224 ecfp256i 177184 177216 177312 ecfp256q 191424 193408 193664 surf127eps 207904 208000 208640 ecfp256h 213024 215520 218592 gls1271 227200 227360 227616 ecfp256s 218656 229472 230336 sclaus1024 538912 542624 543008 surf2113 614816 616000 618560 ed448goldilocks 683872 685376 685632 nistp256 855488 866592 874656 hector 993152 996064 999456 ed521gs 1123584 1126592 1133664 sclaus2048 1190016 1191904 1193920 nist521gs 1289728 1290560 1292672 claus Secret key bytes system 20 sclaus1024 28 sclaus2048 28 surf2113 29 hector 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 32 gls1271 48 kummer 48 surf127eps 48 surf2113 56 ed448goldilocks 60 hector 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 48 surf2113 60 hector 64 ed448goldilocks 64 gls254 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

x86; normally amd64; Zen (800f11); 2017 AMD Ryzen 5 1600; 6 x 3200MHz; rumba5, supercop-20181113

Cycles to generate a key pair quartile median quartile system 119296 119424 119648 k277mon 598208 599008 599840 kummer 660160 660384 661760 curve25519 665056 666432 667488 nistp256 1098816 1099904 1102176 ed448goldilocks Cycles to compute a shared secret quartile median quartile system 119296 120000 120160 k277mon 595168 598016 598112 kummer 659712 659968 660064 curve25519 2241600 2244608 2249504 nistp256 3629920 3647744 3656032 ed448goldilocks Secret key bytes system 32 curve25519 32 kummer 32 nistp256 48 k277mon 144 ed448goldilocks Public key bytes system 32 curve25519 48 kummer 56 ed448goldilocks 64 nistp256 80 k277mon Shared secret bytes system 32 curve25519 40 k277mon 48 kummer 64 ed448goldilocks 64 nistp256

amd64; KabyLake (906e9); 2017 Intel Xeon E3-1220 v6; 4 x 3000MHz; kizomba, supercop-20181113

Cycles to generate a key pair quartile median quartile system 36569 36752 37194 gls254 38355 38508 39210 curve2251 38544 38584 38639 gls254prot 45740 45772 45804 k277taa 50089 50415 50518 kummer 51225 51369 57026 k298 70365 70457 71774 k277mon 126077 126448 131389 curve25519 152731 153052 153363 ed448goldilocks 178941 181657 189315 sclaus1024 181484 182234 184088 surf127eps 316790 317274 332570 nistp256 823922 824867 844206 ed521gs 891710 900042 913153 sclaus2048 999168 1001177 1033717 nist521gs 1060812 1079594 1198655 claus Cycles to compute a shared secret quartile median quartile system 35534 35571 35601 gls254 38299 38343 38390 gls254prot 45458 45485 45512 k277taa 49971? 50059? 72264? kummer 50780 50863 51044 k298 70321 71150 71728 k277mon 134784 136044 136240 curve25519 145393 145956 146280 curve2251 177823 178117 182256 sclaus1024 177405 178211 179365 surf127eps 456156 456448 456764 ed448goldilocks 575218 575742 582020 nistp256 823019 824579 858240 ed521gs 903186 907593 923967 sclaus2048 999047 1000032 1025092 nist521gs 1058814 1060895 1082671 claus Secret key bytes system 20 sclaus1024 28 sclaus2048 32 curve2251 32 curve25519 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 56 ed448goldilocks 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

x86; normally amd64; KabyLake (906e9); 2017 Intel Xeon E3-1220 v6; 4 x 3000MHz; kizomba, supercop-20181113

Cycles to generate a key pair quartile median quartile system 94008 94092 94216 k277mon 465212 465726 476415 kummer 599430 599958 605842 nistp256 692046 692815 694349 curve25519 949588 950500 961596 ed448goldilocks Cycles to compute a shared secret quartile median quartile system 93923 93996 94067 k277mon 465240 465609 472262 kummer 692339 693286 711690 curve25519 2093186 2102643 2164617 nistp256 3158514 3186357 3245157 ed448goldilocks Secret key bytes system 32 curve25519 32 kummer 32 nistp256 48 k277mon 144 ed448goldilocks Public key bytes system 32 curve25519 48 kummer 56 ed448goldilocks 64 nistp256 80 k277mon Shared secret bytes system 32 curve25519 40 k277mon 48 kummer 64 ed448goldilocks 64 nistp256

amd64; SL+512x2 (50654); 2017 Intel Xeon Gold 6150; 18 x 2700MHz; manny1024, supercop-20170904

Cycles to generate a key pair quartile median quartile system 35846 36468 37368 gls254 37496 37532 37578 gls254prot 38200 38812 43474 curve2251 44762 44854 44912 k277taa 44638 45616 47390 ecfp256e 46430 47844 51736 ecfp256h 48126 48930 51172 ecfp256s 50950 51008 51126 k298 51338 52794 60152 ecfp256q 56708 56778 61264 kummer 60798 60874 60948 k277mon 126252 127094 127352 curve25519 178730 180396 182318 sclaus1024 194250 194592 194988 ed448goldilocks 196376 197216 197770 surf127eps 198096 199446 200970 ecfp256i 284370 284852 285362 nistp256 904142 917380 970450 sclaus2048 1064698 1070206 1079248 claus 1511902 1519730 1523824 ed521gs 1830512 1837766 1855930 nist521gs Cycles to compute a shared secret quartile median quartile system 34826 35040 35084 gls254 37430 37456 37492 gls254prot 44776 44810 44858 k277taa 50760 50852 50928 k298 56676 56742 61220 kummer 59494 59526 59560 k277mon 136180 136650 137372 curve25519 145356 145976 146144 curve2251 179620 182742 184014 sclaus1024 186030 186206 186422 ecfp256e 191674 192000 192444 surf127eps 193114 193376 193694 ecfp256q 195264 195476 195742 ecfp256i 224348 224534 224890 ecfp256h 249054 249288 249716 ecfp256s 503062 503288 503620 ed448goldilocks 579310 580438 583748 nistp256 900404 907680 984444 sclaus2048 1067904 1069148 1080216 claus 1509140 1518006 1521566 ed521gs 1823876 1834210 1839432 nist521gs Secret key bytes system 20 sclaus1024 28 sclaus2048 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; SL+512x2 (50654); 2017 Intel Xeon Gold 6148; 40 x 2400MHz; genji548, supercop-20180818

Cycles to generate a key pair quartile median quartile system 35786 36236 36722 gls254 37560 37600 37736 gls254prot 38012 38540 41954 curve2251 44888 44930 44972 k277taa 44424 46050 48442 ecfp256e 47490 48394 51370 ecfp256s 46720 50324 56768 ecfp256h 51028 51358 56082 k298 52498 55822 60502 ecfp256q 56632 56708 61676 kummer 60970 61016 61086 k277mon 127054 128574 138374 curve25519 187454 187830 188368 ed448goldilocks 196164 197086 198208 surf127eps 198538 199490 201386 ecfp256i 283072 283372 283790 nistp256 976938 992232 1028940 claus 1551740 1561496 1594550 ed521gs 1839030 1850828 2012756 nist521gs Cycles to compute a shared secret quartile median quartile system 34810 35034 35070 gls254 37476 37520 38780 gls254prot 44806 44840 44878 k277taa 50864 50948 54990 k298 56560 56618 56658 kummer 59508 59532 59580 k277mon 135750 136336 136542 curve25519 145938 146166 146680 curve2251 185206 185406 188956 ecfp256e 190584 191048 191786 surf127eps 194316 194788 204854 ecfp256q 195270 195494 195774 ecfp256i 224484 224852 241100 ecfp256h 248192 248420 248796 ecfp256s 504404 504646 519480 ed448goldilocks 581042 581358 589254 nistp256 988178 1017648 1029230 claus 1537840 1551942 1570522 ed521gs 1834436 1839830 1843328 nist521gs Secret key bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 144 ed521gs 144 nist521gs Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus

amd64; SL+512x2 (50654); 2017 Intel Xeon Gold 6130; 32 x 2100MHz; genji239, supercop-20171020

Cycles to generate a key pair quartile median quartile system 35854 36420 36810 gls254 37476 37518 37570 gls254prot 38142 38888 44272 curve2251 44808 44840 44884 k277taa 44006 45186 48418 ecfp256e 46450 49346 57038 ecfp256h 48424 49712 53260 ecfp256s 51244 51302 51404 k298 50596 52504 57102 ecfp256q 56684 56740 57126 kummer 59638 59788 59884 k277mon 125786 126850 127058 curve25519 178960 180542 182160 sclaus1024 189260 189642 195088 ed448goldilocks 196810 197938 208580 surf127eps 197312 198778 200254 ecfp256i 283280 283488 284052 nistp256 909320 936850 968592 sclaus2048 1067582 1080252 1102604 claus 1520346 1525502 1578742 ed521gs 1828812 1832772 1836130 nist521gs Cycles to compute a shared secret quartile median quartile system 34994 35028 35066 gls254 37400 37428 37460 gls254prot 44740 44778 44810 k277taa 51064 51186 51272 k298 56638 56692 56766 kummer 59526 59570 59832 k277mon 136166 136394 136518 curve25519 143902 146606 151802 curve2251 182314 183348 188508 sclaus1024 183174 185204 187048 ecfp256e 190000 191024 198248 surf127eps 191056 192580 192926 ecfp256q 193632 195144 195456 ecfp256i 224030 226220 226562 ecfp256h 246996 247428 249798 ecfp256s 501650 502352 510688 ed448goldilocks 581508 581870 586320 nistp256 895494 929078 976544 sclaus2048 1070188 1074918 1082448 claus 1517788 1520776 1526740 ed521gs 1828316 1831348 1834128 nist521gs Secret key bytes system 20 sclaus1024 28 sclaus2048 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; SL+512x2 (50654); 2017 Intel Core i7-7800X; 6 x 3500MHz; unstable; oki, supercop-20171218

Cycles to generate a key pair quartile median quartile system 25222 26284 28626 jacfp127i 26760 28640 30070 kumjacfp127g 28084 31172 32712 hecfp127i 32504 33044 33596 gls254 34264 34310 34358 gls254prot 33654 34586 35608 curve2251 30776 34590 37756 prjfp127i 32990 35394 36912 jacfp128bk 36268 37060 38758 ecfp256e 36960 38906 41180 hecfp128bk 37596 38988 41498 hecfp128i 38982 39994 43398 ecfp256s 41206 41248 41300 k277taa 41556 42672 46446 ecfp256q 40366 44390 46996 prjfp128bk 39272 44678 47392 hecfp128fkt 45464 45608 46266 kummer 39304? 46026? 50400? ecfp256h 50498 50628 50728 k298 65034 65086 65144 k277mon 71306 71380 71456 kumfp127g 101110 106292 106398 kumfp128g 110826 111194 111640 curve25519 117562 119324 121130 gls1271 135000 135216 135498 ed448goldilocks 166668 167466 168506 ecfp256i 284576 285212 285374 nistp256 742876 743278 744058 ed521gs 866278 866728 867154 nist521gs Cycles to compute a shared secret quartile median quartile system 31498 31758 31804 gls254 34176 34212 34250 gls254prot 41138 41178 41206 k277taa 44922 45166 45606 kummer 50506 51078 51158 k298 64968 65016 65068 k277mon 73386 73450 73534 kumfp127g 73426 73524 77256 kumjacfp127g 88406 88564 88754 jacfp128bk 105146 106026 106278 prjfp128bk 108556 108814 109052 hecfp128bk 105950 111376 111460 kumfp128g 112052 112262 112498 hecfp128fkt 116414 116602 116818 jacfp127i 119416 119760 120124 curve25519 127426 127672 127844 curve2251 150748 151142 151448 prjfp127i 153438 153626 153798 ecfp256e 154406 154552 154680 hecfp127i 162924 163050 163232 ecfp256q 164036 164222 168120 ecfp256i 191688 191932 239230 ecfp256h 208902 210542 210726 ecfp256s 223900 224158 224352 hecfp128i 264876 266438 268024 gls1271 404816 405272 406222 ed448goldilocks 510762 514484 514748 nistp256 741760 741888 742130 ed521gs 866106 866434 866994 nist521gs Secret key bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 32 hecfp127i 32 hecfp128bk 32 hecfp128fkt 32 hecfp128i 32 jacfp127i 32 jacfp128bk 32 k298 32 kumfp127g 32 kumfp128g 32 kumjacfp127g 32 kummer 32 nistp256 32 prjfp127i 32 prjfp128bk 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks Public key bytes system 32 curve2251 32 curve25519 32 gls1271 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 80 k277mon 80 k277taa 96 ecfp256i 96 k298 144 ed521gs 144 nist521gs Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 64 ed448goldilocks 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 72 ed521gs 72 nist521gs

amd64; KnLanding (50671); 2016 Intel Xeon Phi 7250; 68 x 1400MHz; genji291, supercop-20180818

Cycles to generate a key pair quartile median quartile system 69706 69762 70252 gls254 73976 74004 76188 gls254prot 79254 79254 79352 k277taa 86058 89908 95466 curve2251 99960 100520 102214 k298 107576 107618 108640 kummer 109620 109634 109858 k277mon 121660 122794 127596 ecfp256e 128870 130718 134232 ecfp256h 133042 136234 139664 ecfp256s 138964 140658 144494 ecfp256q 289002 289072 292852 curve25519 542276 549458 564186 nistp256 640472 649810 664594 ecfp256i 716114 725788 751436 surf127eps 783818 794472 808710 ed448goldilocks 5275690 5353544 5597032 ed521gs 6424054 6434624 6449492 nist521gs 12591390 12614784 12659178 claus Cycles to compute a shared secret quartile median quartile system 68950 68950 68978 gls254 73864 73864 73878 gls254prot 79184 79184 79198 k277taa 99260 99456 99582 k298 107534 107534 108164 kummer 109564 109578 109578 k277mon 272944 273630 299796 curve2251 300776 300874 303002 curve25519 613718 636132 669256 ecfp256e 637644 641550 660282 ecfp256i 624022 642922 653506 ecfp256q 711536 721588 728854 surf127eps 756840 775922 780528 ecfp256h 784924 802060 812630 ecfp256s 1922830 1939896 1949990 nistp256 2450266 2459086 2474374 ed448goldilocks 5245758 5318530 5385002 ed521gs 6422724 6430620 6440728 nist521gs 12570460 12593700 12643050 claus Secret key bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 32 k298 32 kummer 32 nistp256 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 144 ed521gs 144 nist521gs Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 40 k277mon 40 k277taa 48 k298 48 kummer 48 surf127eps 64 ed448goldilocks 64 nistp256 72 ed521gs 72 nist521gs 128 claus

amd64; KnLanding (50671); 2016 Intel Xeon Phi 7250; 68 x 1400MHz; unstable; pluton1mn, supercop-20160806

Cycles to generate a key pair quartile median quartile system 91686 92386 93730 gls254 90720 92778 94892 curve2251 96026 96068 96096 kummer 105980 107142 108640 ecfp256e 117474 118594 122304 ecfp256h 118566 118608 118678 gls254prot 118286 120078 122514 ecfp256s 125762 129136 132034 ecfp256q 282674 282758 286748 curve25519 523558 525000 541646 nistp256 590534 597660 611618 ecfp256i 675052 684306 693294 surf127eps 805798 817810 824642 ed448goldilocks 948892 968702 975870 surf2113 1701224 1717352 1738450 sclaus1024 3985464 3990098 4003986 ed521gs 4786656 4802602 4917626 nist521gs 6990004 6996920 7010626 claus 8350034 8411396 8490902 sclaus2048 Cycles to compute a shared secret quartile median quartile system 77644 77728 78078 gls254 83930 83930 84014 kummer 106092 106092 106120 gls254prot 254604 254716 255486 curve2251 282114 282128 287812 curve25519 551754 554848 574518 ecfp256e 588686 590002 609742 ecfp256i 578606 590268 604226 ecfp256q 656026 664384 672140 surf127eps 706034 723534 728826 ecfp256h 711564 729302 734412 ecfp256s 932330 955514 958734 surf2113 1690430 1694154 1699600 sclaus1024 1812342 1827756 1841126 nistp256 2824710 2828630 2834846 ed448goldilocks 3935554 3941126 3946740 ed521gs 4747624 4759748 4848046 nist521gs 6951560 6957230 6962508 claus 8517362 8522654 8529094 sclaus2048 Secret key bytes system 20 sclaus1024 28 sclaus2048 28 surf2113 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls254 32 gls254prot 32 kummer 32 nistp256 32 surf127eps 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 48 kummer 48 surf127eps 48 surf2113 56 ed448goldilocks 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 nistp256 96 ecfp256i 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 48 kummer 48 surf127eps 48 surf2113 64 ed448goldilocks 64 gls254 64 gls254prot 64 nistp256 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; KnLanding (50671); 2016 Intel Xeon Phi 7210; 64 x 1300MHz; genji154, supercop-20170228

Cycles to generate a key pair quartile median quartile system 80015 80184 80548 gls254 94796 96915 97084 kummer 98761 98800 99281 k277taa 96434 100100 102687 curve2251 104533 105742 108771 kumjacfp127g 106145 107614 109083 jacfp127i 108940 109928 112255 prjfp127i 109148 110747 114686 hecfp127i 114283 115362 117065 ecfp256e 119535 119717 120926 k298 126971 127023 142155 gls254prot 128206 128206 128622 k277mon 129142 130793 133029 ecfp256s 130572 132236 135590 ecfp256h 136175 138229 142220 ecfp256q 143338 144560 152750 jacfp128bk 159978 161265 171665 hecfp128bk 160771 161876 167492 prjfp128bk 162058 163592 170313 hecfp128fkt 163436 164827 169377 hecfp128i 188032 190736 194909 gls1271 300248 300495 318838 curve25519 338546 339833 356005 kumfp127g 537290 556465 590837 hector 561938 568334 582738 nistp256 582504 586755 599287 kumfp128g 633113 646568 660621 ecfp256i 709774 721058 728091 surf127eps 730288 740441 766792 ed448goldilocks 1028599 1039337 1046825 surf2113 1858909 1886105 1927380 sclaus1024 4311814 4321057 4338438 ed521gs 5180097 5210283 5261685 nist521gs 7616661 7675070 7772817 claus 8972717 9026225 9091264 sclaus2048 Cycles to compute a shared secret quartile median quartile system 66742 66768 66781 gls254 80145 80158 80509 k277taa 83525 83564 85852 kummer 107237 107367 107523 k298 109564 109577 109629 k277mon 113633 113646 137124 gls254prot 272857 273455 277745 curve2251 300781 301444 320255 curve25519 342368 343629 359866 kumfp127g 344903 345826 362115 kumjacfp127g 444080 445952 467766 gls1271 452647 453310 476879 jacfp128bk 522548 523172 548704 prjfp128bk 526370 527085 548236 hecfp128bk 545402 551122 571415 hecfp128fkt 564382 570947 594698 jacfp127i 591448 595647 616226 ecfp256e 597831 600184 613392 kumfp128g 620308 637117 646815 ecfp256q 629967 639860 655382 ecfp256i 658840 680745 689195 prjfp127i 676195 697541 707759 hecfp127i 695916 706563 712088 surf127eps 762307 780520 790010 ecfp256h 767169 785564 794378 ecfp256s 1021111 1025856 1039402 surf2113 1100528 1112943 1121549 hecfp128i 1671228 1677689 1690533 hector 1841606 1855633 1887392 sclaus1024 1938443 1946048 1953380 nistp256 2266550 2277158 2301273 ed448goldilocks 4260919 4270955 4281446 ed521gs 5137925 5165290 5193188 nist521gs 7557290 7574736 7673575 claus 9138701 9143719 9151662 sclaus2048 Secret key bytes system 20 sclaus1024 28 sclaus2048 28 surf2113 29 hector 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 32 gls254prot 32 hecfp127i 32 hecfp128bk 32 hecfp128fkt 32 hecfp128i 32 jacfp127i 32 jacfp128bk 32 k298 32 kumfp127g 32 kumfp128g 32 kumjacfp127g 32 kummer 32 nistp256 32 prjfp127i 32 prjfp128bk 32 surf127eps 48 k277mon 48 k277taa 104 nist521gs 130 ed521gs 144 ed448goldilocks 256 claus Public key bytes system 32 curve2251 32 curve25519 32 gls1271 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 48 surf127eps 48 surf2113 56 ed448goldilocks 60 hector 64 ecfp256e 64 ecfp256h 64 ecfp256q 64 ecfp256s 64 gls254 64 gls254prot 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 80 k277mon 80 k277taa 96 ecfp256i 96 k298 128 claus 128 sclaus1024 144 ed521gs 144 nist521gs 256 sclaus2048 Shared secret bytes system 32 curve2251 32 curve25519 32 ecfp256e 32 ecfp256h 32 ecfp256i 32 ecfp256q 32 ecfp256s 32 gls1271 32 gls254 40 k277mon 40 k277taa 48 k298 48 kumfp127g 48 kumfp128g 48 kumjacfp127g 48 kummer 48 surf127eps 48 surf2113 60 hector 64 ed448goldilocks 64 gls254prot 64 hecfp127i 64 hecfp128bk 64 hecfp128fkt 64 hecfp128i 64 jacfp127i 64 jacfp128bk 64 nistp256 64 prjfp127i 64 prjfp128bk 72 ed521gs 72 nist521gs 128 claus 128 sclaus1024 256 sclaus2048

amd64; BW+AES (406f1); 2016 Intel Xeon E5-2680 v4; 28 x 2400MHz; genji122, supercop-20171020