VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates, indexed by machine

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation.

Each computer name is linked to additional information about the implementations and compilers selected for benchmarking.

There is a separate page with more information about each cipher and each implementation.

amd64; Zen 4 (a60f12); 2023 AMD Ryzen 7 7700; 8 x 3800MHz; hertz, supercop-20240107

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 0.80 0.81 0.82 T:aes128gcmv1 0.88 0.90 0.90 aes256gcmv1 6.13 6.13 6.13 ascon128av12 9.00 9.00 9.00 ascon80pqv12 9.13 9.13 9.13 ascon128v12 11.88 11.93 11.99 T:xoodyakround3 12.32 12.38 12.42 ascon128abi32v12 17.09 17.12 17.15 T:grain128aeadv2 17.48 17.53 17.60 T:schwaemm256128v2 18.44 18.51 18.56 ascon128bi32v12 23.78 23.84 23.96 T:schwaemm192192v2 24.31 24.39 24.81 T:schwaemm256256v2 25.73 25.74 25.75 T:isapa128av20 26.70 26.79 26.94 T:schwaemm128128v2 30.75 30.75 30.75 T:giftcofb128v1 35.64 35.64 35.64 T:isapa128v20 41.48 42.05 42.27 romulusn 46.27 48.23 48.46 T:isapk128av20 64.12 64.45 64.95 romulusm 72.30 72.34 72.43 T:isapk128v20 73.25 73.26 73.26 T:tinyjambu128v2 82.74 82.74 82.75 T:tinyjambu192v2 91.24 91.26 91.26 T:tinyjambu256v2 133.66 133.71 133.84 romulust 164.26 165.45 165.84 T:isapxv20 201.31 201.36 201.80 T:elephant200v2 7526.42 7528.29 7591.45 T:elephant176v2 7885.35 7888.95 7890.77 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 0.68 0.69 0.71 T:aes128gcmv1 0.80 0.81 0.82 aes256gcmv1 6.18 6.19 6.19 ascon128av12 8.75 8.75 8.76 ascon128v12 8.89 9.00 9.01 ascon80pqv12 11.82 11.89 11.93 T:xoodyakround3 12.40 12.44 12.48 ascon128abi32v12 17.48 17.51 17.53 T:grain128aeadv2 17.61 17.67 17.75 T:schwaemm256128v2 18.50 18.50 18.50 ascon128bi32v12 23.85 23.91 24.02 T:schwaemm192192v2 24.58 24.65 24.79 T:schwaemm256256v2 26.67 26.70 26.75 T:isapa128av20 27.09 27.40 27.62 T:schwaemm128128v2 30.93 30.94 30.94 T:giftcofb128v1 35.64 35.64 35.68 T:isapa128v20 41.33 41.35 41.40 romulusn 46.56 48.03 48.44 T:isapk128av20 64.54 64.73 65.05 romulusm 72.30 72.36 72.48 T:isapk128v20 73.50 73.51 73.51 T:tinyjambu128v2 82.98 82.99 83.00 T:tinyjambu192v2 91.48 91.51 91.51 T:tinyjambu256v2 133.76 133.99 134.09 romulust 163.47 164.04 166.19 T:isapxv20 201.24 201.25 201.38 T:elephant200v2 7526.41 7527.48 7530.18 T:elephant176v2 7890.13 7890.72 7891.93 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 0.69 0.69 0.70 T:aes128gcmv1 0.79 0.80 0.82 aes256gcmv1 6.19 6.19 6.20 ascon128av12 8.75 8.75 8.76 ascon128v12 9.00 9.00 9.01 ascon80pqv12 11.88 11.93 11.96 T:xoodyakround3 12.43 12.44 12.48 ascon128abi32v12 17.47 17.51 17.55 T:grain128aeadv2 17.63 17.71 17.82 T:schwaemm256128v2 17.72 17.76 17.77 T:isapa128av20 17.72 17.76 17.79 T:isapa128v20 18.50 18.50 18.51 ascon128bi32v12 23.81 23.88 23.92 T:schwaemm192192v2 24.53 24.65 24.86 T:schwaemm256256v2 26.84 26.99 27.11 T:schwaemm128128v2 30.93 30.94 30.94 T:giftcofb128v1 30.94 32.00 32.20 T:isapk128av20 41.35 41.53 41.61 romulusn 44.47 44.56 44.69 romulust 45.14 45.21 45.46 T:isapk128v20 64.49 64.82 65.39 romulusm 73.51 73.51 73.52 T:tinyjambu128v2 83.00 83.00 83.00 T:tinyjambu192v2 91.51 91.51 91.51 T:tinyjambu256v2 96.81 98.62 99.00 T:isapxv20 201.26 201.32 201.73 T:elephant200v2 7528.35 7530.87 7531.85 T:elephant176v2 7888.34 7889.56 7900.56 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.58 0.61 0.62 T:aes128gcmv1 0.63 0.65 0.67 aes256gcmv1 6.13 6.14 6.14 ascon128av12 8.89 8.92 8.96 T:xoodyakround3 9.00 9.00 9.01 ascon128v12 9.06 9.06 9.07 ascon80pqv12 12.44 12.44 12.45 ascon128abi32v12 17.51 17.53 17.56 T:grain128aeadv2 17.47 17.54 17.69 T:schwaemm256128v2 18.37 18.38 18.40 ascon128bi32v12 21.81 21.82 21.84 T:isapa128av20 23.81 23.90 24.07 T:schwaemm192192v2 24.32 24.44 24.54 T:schwaemm256256v2 26.87 26.88 26.90 T:isapa128v20 26.82 26.91 27.05 T:schwaemm128128v2 30.93 30.98 30.98 T:giftcofb128v1 32.05 32.15 32.57 romulusn 38.52 38.60 38.64 T:isapk128av20 43.45 43.59 44.00 romulusm 58.65 58.71 58.75 T:isapk128v20 59.74 59.76 59.77 T:tinyjambu128v2 64.74 64.76 64.76 T:tinyjambu192v2 68.75 68.76 68.77 T:tinyjambu256v2 89.08 89.13 89.24 romulust 130.61 131.03 131.31 T:isapxv20 151.26 151.29 151.31 T:elephant200v2 5626.45 5627.77 5630.73 T:elephant176v2 5917.81 5918.85 5919.23 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.52 0.54 0.56 T:aes128gcmv1 0.58 0.60 0.63 aes256gcmv1 6.00 6.00 6.02 ascon128av12 8.85 8.89 8.92 T:xoodyakround3 9.04 9.04 9.05 ascon80pqv12 9.06 9.07 9.07 ascon128v12 12.45 12.47 12.49 ascon128abi32v12 17.46 17.49 17.52 T:schwaemm256128v2 17.56 17.60 17.64 T:grain128aeadv2 18.53 18.54 18.54 ascon128bi32v12 22.21 22.21 22.25 T:isapa128av20 23.77 23.87 23.99 T:schwaemm192192v2 24.42 24.45 24.50 T:schwaemm256256v2 26.71 26.79 26.90 T:schwaemm128128v2 26.86 26.88 26.90 T:isapa128v20 31.02 31.02 31.08 T:giftcofb128v1 32.07 32.15 32.25 romulusn 38.52 38.58 40.08 T:isapk128av20 43.62 43.85 43.94 romulusm 58.54 58.61 58.67 T:isapk128v20 59.88 59.89 59.89 T:tinyjambu128v2 64.87 64.88 64.88 T:tinyjambu192v2 68.88 68.89 68.89 T:tinyjambu256v2 89.05 89.09 89.21 romulust 130.36 131.03 131.54 T:isapxv20 151.22 151.25 151.27 T:elephant200v2 5621.11 5624.36 5625.02 T:elephant176v2 5918.61 5919.87 5920.96 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.54 0.54 0.55 T:aes128gcmv1 0.59 0.60 0.60 aes256gcmv1 6.00 6.00 6.04 ascon128av12 8.87 8.91 8.95 T:xoodyakround3 9.04 9.04 9.05 ascon80pqv12 9.06 9.07 9.07 ascon128v12 12.47 12.47 12.48 ascon128abi32v12 17.45 17.50 17.55 T:schwaemm256128v2 17.56 17.57 17.59 T:grain128aeadv2 17.75 17.75 17.76 T:isapa128av20 17.92 17.93 17.96 T:isapa128v20 18.54 18.54 18.54 ascon128bi32v12 23.77 23.83 23.94 T:schwaemm192192v2 24.30 24.45 24.58 T:schwaemm256256v2 26.64 26.78 26.87 T:schwaemm128128v2 31.02 31.02 31.07 T:giftcofb128v1 30.94 32.09 32.17 T:isapk128av20 32.07 32.10 32.16 romulusn 43.62 43.77 43.90 romulusm 44.57 44.62 44.66 romulust 45.09 45.13 45.14 T:isapk128v20 59.88 59.89 59.89 T:tinyjambu128v2 64.88 64.88 64.88 T:tinyjambu192v2 68.89 68.89 68.89 T:tinyjambu256v2 97.68 98.05 98.26 T:isapxv20 151.25 151.31 151.62 T:elephant200v2 5623.93 5624.57 5625.04 T:elephant176v2 5919.20 5919.74 5920.12 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.38 0.40 0.42 T:aes128gcmv1 0.39 0.40 0.43 aes256gcmv1 5.77 5.85 5.87 T:xoodyakround3 6.12 6.13 6.13 ascon128av12 8.87 8.88 8.88 ascon128v12 9.12 9.12 9.13 ascon80pqv12 12.48 12.50 12.54 ascon128abi32v12 17.28 17.31 17.39 T:schwaemm256128v2 17.87 17.87 17.88 T:isapa128av20 17.91 17.95 17.96 T:grain128aeadv2 18.13 18.13 18.14 T:isapa128v20 18.19 18.25 18.32 ascon128bi32v12 22.72 22.73 22.81 romulusn 22.73 22.76 22.86 romulusm 23.72 23.79 24.18 T:schwaemm192192v2 24.31 24.35 24.41 T:schwaemm256256v2 26.56 26.69 26.82 T:schwaemm128128v2 30.97 31.03 31.12 T:isapk128av20 31.20 31.21 31.21 T:giftcofb128v1 44.47 44.49 44.52 romulust 44.79 44.87 44.98 T:isapk128v20 46.24 46.25 46.26 T:tinyjambu256v2 46.23 46.26 46.27 T:tinyjambu128v2 46.74 46.76 46.76 T:tinyjambu192v2 96.76 97.21 97.71 T:isapxv20 101.33 101.61 101.83 T:elephant200v2 3719.73 3720.37 3721.37 T:elephant176v2 3949.89 3952.93 3953.20 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.39 0.40 0.43 aes256gcmv1 0.39 0.40 0.43 T:aes128gcmv1 5.82 5.90 5.93 T:xoodyakround3 5.93 5.94 5.94 ascon128av12 9.08 9.08 9.08 ascon80pqv12 9.37 9.38 9.38 ascon128v12 12.47 12.50 12.53 ascon128abi32v12 17.27 17.33 17.40 T:schwaemm256128v2 17.64 17.66 17.69 T:grain128aeadv2 17.74 17.75 17.76 T:isapa128av20 18.13 18.17 18.18 T:isapa128v20 18.56 18.57 18.57 ascon128bi32v12 22.74 22.74 22.81 romulusn 22.73 22.74 23.04 romulusm 23.78 23.89 24.02 T:schwaemm192192v2 24.30 24.37 24.84 T:schwaemm256256v2 26.48 26.67 26.84 T:schwaemm128128v2 30.96 31.10 32.15 T:isapk128av20 31.10 31.21 31.22 T:giftcofb128v1 44.46 44.53 44.57 romulust 44.82 44.92 44.95 T:isapk128v20 46.25 46.26 46.26 T:tinyjambu256v2 46.26 46.26 46.27 T:tinyjambu128v2 46.76 46.76 46.76 T:tinyjambu192v2 96.82 97.24 97.57 T:isapxv20 101.34 101.51 101.57 T:elephant200v2 3720.57 3721.25 3721.98 T:elephant176v2 3951.22 3951.64 3952.69 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.40 0.40 0.40 aes256gcmv1 0.40 0.40 0.40 T:aes128gcmv1 5.79 5.91 6.03 T:xoodyakround3 5.94 5.94 5.94 ascon128av12 9.08 9.08 9.08 ascon80pqv12 9.38 9.38 9.38 ascon128v12 12.50 12.50 12.51 ascon128abi32v12 17.31 17.35 17.40 T:schwaemm256128v2 17.63 17.66 17.68 T:grain128aeadv2 17.71 17.75 17.79 T:isapa128av20 18.10 18.14 18.17 T:isapa128v20 18.56 18.57 18.57 ascon128bi32v12 22.72 22.74 22.74 romulusn 22.73 22.75 23.06 romulusm 23.78 23.86 24.07 T:schwaemm192192v2 24.28 24.34 24.56 T:schwaemm256256v2 26.52 26.62 26.76 T:schwaemm128128v2 31.10 31.21 31.22 T:giftcofb128v1 30.86 31.87 32.16 T:isapk128av20 44.44 44.52 44.57 romulust 44.72 44.77 44.93 T:isapk128v20 46.26 46.26 46.26 T:tinyjambu256v2 46.26 46.26 46.27 T:tinyjambu128v2 46.76 46.76 46.77 T:tinyjambu192v2 96.41 97.76 98.48 T:isapxv20 101.31 101.50 101.55 T:elephant200v2 3722.88 3750.04 3753.31 T:elephant176v2 3951.06 3952.83 3953.10 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 0.69 0.69 0.71 T:aes128gcmv1 0.75 0.75 0.77 aes256gcmv1 6.27 6.27 6.28 ascon128av12 9.00 9.01 9.03 T:xoodyakround3 9.15 9.15 9.16 ascon128v12 9.20 9.20 9.20 ascon80pqv12 12.73 12.74 12.75 ascon128abi32v12 17.86 17.87 17.89 T:grain128aeadv2 17.95 17.98 18.02 T:schwaemm256128v2 18.77 18.77 18.79 ascon128bi32v12 23.36 23.36 23.37 T:isapa128av20 24.36 24.43 24.63 T:schwaemm192192v2 25.06 25.15 25.45 T:schwaemm256256v2 27.01 27.15 27.25 T:schwaemm128128v2 31.22 31.22 31.23 T:giftcofb128v1 32.41 32.45 32.66 romulusn 39.35 39.36 39.37 T:isapa128v20 43.80 43.93 44.29 romulusm 44.54 44.57 44.63 T:isapk128av20 60.21 60.22 60.22 T:tinyjambu128v2 65.24 65.24 65.25 T:tinyjambu192v2 69.26 69.26 69.27 T:tinyjambu256v2 90.47 90.52 90.59 romulust 102.09 102.16 102.22 T:isapk128v20 154.39 154.41 154.44 T:elephant200v2 220.82 222.00 222.85 T:isapxv20 5668.22 5668.88 5671.82 T:elephant176v2 5984.60 5985.77 5991.91 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 0.64 0.64 0.67 T:aes128gcmv1 0.70 0.71 0.74 aes256gcmv1 6.15 6.15 6.22 ascon128av12 8.95 8.95 8.99 T:xoodyakround3 9.18 9.18 9.18 ascon80pqv12 9.22 9.22 9.22 ascon128v12 12.76 12.76 12.78 ascon128abi32v12 17.90 17.92 17.94 T:grain128aeadv2 18.05 18.08 18.12 T:schwaemm256128v2 19.00 19.00 19.00 ascon128bi32v12 23.72 23.72 23.74 T:isapa128av20 24.33 24.35 24.41 T:schwaemm192192v2 25.14 25.17 25.18 T:schwaemm256256v2 27.13 27.18 27.33 T:schwaemm128128v2 31.27 31.32 31.32 T:giftcofb128v1 32.37 32.40 32.43 romulusn 39.36 39.36 39.38 T:isapa128v20 44.18 44.28 44.44 romulusm 43.13 44.48 44.56 T:isapk128av20 60.34 60.34 60.34 T:tinyjambu128v2 65.37 65.37 65.37 T:tinyjambu192v2 69.38 69.39 69.39 T:tinyjambu256v2 90.47 90.60 90.69 romulust 102.08 102.11 102.16 T:isapk128v20 154.38 154.42 154.45 T:elephant200v2 220.99 221.51 221.72 T:isapxv20 5667.32 5668.21 5669.39 T:elephant176v2 5986.43 5986.71 5987.33 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 0.64 0.64 0.64 T:aes128gcmv1 0.70 0.70 0.71 aes256gcmv1 6.15 6.15 6.15 ascon128av12 8.97 8.98 9.09 T:xoodyakround3 9.18 9.18 9.18 ascon80pqv12 9.22 9.22 9.22 ascon128v12 12.76 12.76 12.76 ascon128abi32v12 17.89 17.90 17.92 T:grain128aeadv2 18.02 18.06 18.09 T:schwaemm256128v2 18.60 18.60 18.62 T:isapa128av20 19.00 19.00 19.00 ascon128bi32v12 24.28 24.29 24.31 T:isapa128v20 24.33 24.34 24.37 T:schwaemm192192v2 25.20 25.29 25.48 T:schwaemm256256v2 27.11 27.17 27.23 T:schwaemm128128v2 31.26 31.27 31.32 T:giftcofb128v1 32.37 32.39 32.42 romulusn 33.52 33.61 34.64 T:isapk128av20 44.14 44.27 44.31 romulusm 45.86 45.89 45.90 romulust 60.34 60.34 60.34 T:tinyjambu128v2 65.37 65.37 65.37 T:tinyjambu192v2 67.48 67.50 67.71 T:isapk128v20 69.38 69.39 69.39 T:tinyjambu256v2 144.62 145.16 145.73 T:isapxv20 154.45 154.45 154.67 T:elephant200v2 5668.25 5711.21 5711.95 T:elephant176v2 5986.00 5986.42 5986.80 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 4.79 4.88 4.98 T:aes128gcmv1 5.10 5.18 5.25 aes256gcmv1 9.49 9.49 9.84 ascon128av12 12.21 12.23 12.23 ascon80pqv12 12.58 12.59 12.62 ascon128v12 12.86 12.96 13.44 T:xoodyakround3 19.29 19.29 19.80 ascon128abi32v12 25.16 25.24 25.34 T:grain128aeadv2 27.67 27.67 28.79 ascon128bi32v12 29.99 30.19 30.50 T:schwaemm256128v2 35.22 35.41 35.98 T:schwaemm128128v2 36.79 36.80 36.83 T:giftcofb128v1 38.38 38.41 38.77 romulusn 38.56 38.82 38.95 T:schwaemm192192v2 40.55 40.69 41.00 T:schwaemm256256v2 51.01 51.37 51.41 romulusm 58.33 58.35 58.64 T:isapa128av20 70.52 70.53 70.94 T:tinyjambu128v2 76.18 76.18 76.64 T:tinyjambu192v2 80.64 80.64 81.08 T:tinyjambu256v2 120.94 121.15 121.44 romulust 134.88 138.45 139.32 T:isapk128av20 218.12 218.47 218.66 T:elephant200v2 326.17 326.22 326.37 T:isapa128v20 1090.06 1091.56 1091.77 T:isapk128v20 2272.06 2275.86 2283.02 T:isapxv20 7053.45 7057.77 7114.91 T:elephant176v2 8018.09 8019.98 8022.17 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 5.02 5.10 5.20 T:aes128gcmv1 5.46 5.49 5.64 aes256gcmv1 9.48 9.52 9.68 ascon128av12 12.20 12.20 12.30 ascon80pqv12 12.70 12.71 12.77 ascon128v12 12.96 13.02 13.47 T:xoodyakround3 19.27 19.34 19.66 ascon128abi32v12 25.12 25.23 25.29 T:grain128aeadv2 29.55 29.55 29.57 ascon128bi32v12 30.29 30.50 30.73 T:schwaemm256128v2 35.58 35.98 36.30 T:schwaemm128128v2 36.87 36.87 36.95 T:giftcofb128v1 38.77 38.84 38.85 romulusn 38.49 38.93 39.19 T:schwaemm192192v2 40.47 40.82 40.99 T:schwaemm256256v2 51.62 51.73 51.81 romulusm 57.85 58.11 58.37 T:isapa128av20 70.65 70.65 70.80 T:tinyjambu128v2 76.32 76.32 76.32 T:tinyjambu192v2 80.79 80.79 80.79 T:tinyjambu256v2 121.31 121.38 121.67 romulust 135.02 138.71 139.79 T:isapk128av20 218.35 218.57 218.78 T:elephant200v2 326.26 326.30 326.81 T:isapa128v20 1090.53 1090.77 1090.95 T:isapk128v20 2271.25 2275.44 2282.59 T:isapxv20 7058.38 7062.01 7064.51 T:elephant176v2 8018.10 8019.19 8019.71 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 5.06 5.10 5.19 T:aes128gcmv1 5.46 5.50 5.52 aes256gcmv1 9.48 9.48 9.52 ascon128av12 12.20 12.20 12.20 ascon80pqv12 12.70 12.72 12.74 ascon128v12 12.94 13.34 13.63 T:xoodyakround3 19.24 19.34 19.34 ascon128abi32v12 25.13 25.24 25.31 T:grain128aeadv2 29.55 29.56 29.56 ascon128bi32v12 30.22 30.55 30.90 T:schwaemm256128v2 35.30 35.74 36.16 T:schwaemm128128v2 36.85 36.91 36.95 T:giftcofb128v1 37.91 37.95 38.13 T:isapa128av20 38.26 38.77 38.89 romulusn 38.91 39.20 39.49 T:schwaemm192192v2 40.73 40.91 41.27 T:schwaemm256256v2 51.64 51.71 51.85 romulusm 70.65 70.65 70.66 T:tinyjambu128v2 75.51 75.91 76.19 romulust 76.32 76.32 76.32 T:tinyjambu192v2 80.79 80.79 80.79 T:tinyjambu256v2 84.95 85.59 86.53 T:isapk128av20 170.04 170.09 170.60 T:isapa128v20 218.20 218.53 218.73 T:elephant200v2 575.61 575.79 576.35 T:isapk128v20 1187.82 1190.57 1193.70 T:isapxv20 7053.97 7056.97 7058.80 T:elephant176v2 8020.82 8023.85 8026.61 T:elephant160v2

amd64; Raptor Cove (b06a2); 2023 Intel Core i7-13700H, P cores; 6 x 4800MHz; raptor, supercop-20231107

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 1.41 1.42 1.43 T:aes128gcmv1 1.46 1.54 1.56 aes256gcmv1 6.45 6.51 6.59 ascon128av12 9.82 9.87 9.90 ascon80pqv12 9.95 9.99 10.02 ascon128v12 12.40 12.44 12.54 T:schwaemm256128v2 12.85 13.02 13.18 ascon128abi32v12 13.21 13.25 13.29 T:xoodyakround3 16.39 16.48 16.55 T:schwaemm192192v2 17.28 17.37 17.43 T:schwaemm256256v2 18.22 18.27 18.30 T:schwaemm128128v2 19.09 19.12 19.18 ascon128bi32v12 23.15 23.19 23.24 T:grain128aeadv2 33.02 33.07 33.12 T:giftcofb128v1 38.73 38.75 38.81 romulusn 39.29 39.40 39.58 T:isapa128v20 39.41 39.49 39.54 T:isapa128av20 47.45 48.00 48.14 T:isapk128av20 62.17 62.22 62.28 romulusm 64.46 64.82 65.24 T:isapk128v20 65.46 65.61 65.70 T:tinyjambu128v2 77.99 78.04 78.14 T:tinyjambu192v2 83.85 83.89 84.03 T:tinyjambu256v2 129.64 129.77 129.86 romulust 161.35 161.93 162.57 T:isapxv20 165.95 167.86 168.63 T:elephant200v2 5699.42 5706.57 5732.88 T:elephant176v2 5894.33 5897.40 5908.06 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 1.20 1.21 1.25 T:aes128gcmv1 1.40 1.41 1.42 aes256gcmv1 6.41 6.46 6.47 ascon128av12 9.59 9.61 9.63 ascon80pqv12 9.67 9.72 9.89 ascon128v12 12.44 12.48 12.56 T:schwaemm256128v2 13.05 13.19 13.31 ascon128abi32v12 13.16 13.23 13.26 T:xoodyakround3 16.40 16.48 16.51 T:schwaemm192192v2 17.27 17.36 17.43 T:schwaemm256256v2 18.24 18.27 18.34 T:schwaemm128128v2 19.18 19.26 19.31 ascon128bi32v12 22.51 22.53 22.57 T:grain128aeadv2 33.06 33.08 33.13 T:giftcofb128v1 38.80 38.85 38.94 romulusn 39.22 39.32 39.48 T:isapa128v20 39.40 39.47 39.57 T:isapa128av20 47.39 47.72 48.06 T:isapk128av20 62.15 62.28 62.35 romulusm 64.18 64.84 65.65 T:isapk128v20 65.42 65.46 65.49 T:tinyjambu128v2 77.84 77.93 77.96 T:tinyjambu192v2 84.01 84.07 84.10 T:tinyjambu256v2 129.64 129.75 130.19 romulust 163.38 163.93 164.52 T:isapxv20 168.55 169.18 169.92 T:elephant200v2 5697.51 5706.96 5734.97 T:elephant176v2 5890.70 5895.72 5902.89 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 1.19 1.20 1.26 T:aes128gcmv1 1.40 1.41 1.42 aes256gcmv1 6.43 6.45 6.50 ascon128av12 9.56 9.59 9.65 ascon80pqv12 9.66 9.81 9.91 ascon128v12 12.45 12.51 12.59 T:schwaemm256128v2 13.07 13.16 13.19 ascon128abi32v12 13.11 13.18 13.26 T:xoodyakround3 16.33 16.43 16.47 T:schwaemm192192v2 17.30 17.36 17.40 T:schwaemm256256v2 18.25 18.28 18.33 T:schwaemm128128v2 19.09 19.14 19.19 ascon128bi32v12 19.48 19.61 19.72 T:isapa128v20 22.50 22.55 22.58 T:grain128aeadv2 26.28 26.38 26.48 T:isapa128av20 31.80 32.37 32.41 T:isapk128av20 33.07 33.16 33.23 T:giftcofb128v1 38.80 38.85 38.92 romulusn 40.54 40.58 40.68 T:isapk128v20 44.60 44.68 44.87 romulust 62.19 62.25 62.32 romulusm 65.41 65.44 65.75 T:tinyjambu128v2 77.88 77.93 77.98 T:tinyjambu192v2 83.84 83.88 83.94 T:tinyjambu256v2 98.76 98.89 98.96 T:isapxv20 167.61 168.41 169.03 T:elephant200v2 5698.69 5704.35 5714.10 T:elephant176v2 5891.85 5894.49 5896.83 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.85 0.86 0.87 T:aes128gcmv1 0.92 0.93 0.93 aes256gcmv1 6.47 6.49 6.53 ascon128av12 9.76 9.79 9.82 ascon80pqv12 9.74 9.84 9.90 ascon128v12 10.17 10.20 10.24 T:xoodyakround3 12.32 12.36 12.39 T:schwaemm256128v2 13.31 13.34 13.37 ascon128abi32v12 16.34 16.44 16.46 T:schwaemm192192v2 17.26 17.33 17.40 T:schwaemm256256v2 18.20 18.23 18.26 T:schwaemm128128v2 19.25 19.28 19.32 ascon128bi32v12 23.06 23.15 23.19 T:grain128aeadv2 29.42 29.50 29.58 T:isapa128v20 31.10 31.13 31.16 romulusn 32.72 32.77 32.82 T:isapa128av20 32.94 32.98 33.02 T:giftcofb128v1 40.34 40.59 40.85 T:isapk128av20 42.81 42.87 42.93 romulusm 52.33 52.90 53.16 T:isapk128v20 53.56 53.62 53.66 T:tinyjambu128v2 61.02 61.04 61.11 T:tinyjambu192v2 63.31 63.33 63.48 T:tinyjambu256v2 87.03 87.14 87.19 romulust 124.07 124.41 126.80 T:elephant200v2 128.93 130.09 130.44 T:isapxv20 4258.61 4268.09 4273.79 T:elephant176v2 4420.22 4423.26 4428.60 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.75 0.77 0.78 T:aes128gcmv1 0.85 0.86 0.86 aes256gcmv1 6.43 6.45 6.46 ascon128av12 9.70 9.73 9.75 ascon80pqv12 9.72 9.79 9.82 ascon128v12 10.12 10.15 10.18 T:xoodyakround3 12.33 12.37 12.42 T:schwaemm256128v2 13.15 13.25 13.30 ascon128abi32v12 16.32 16.39 16.44 T:schwaemm192192v2 17.21 17.26 17.38 T:schwaemm256256v2 18.18 18.21 18.23 T:schwaemm128128v2 19.24 19.28 19.31 ascon128bi32v12 22.80 22.86 22.88 T:grain128aeadv2 29.44 29.52 29.60 T:isapa128v20 31.12 31.14 31.18 romulusn 32.71 32.74 32.81 T:isapa128av20 33.00 33.06 33.10 T:giftcofb128v1 40.19 40.45 40.65 T:isapk128av20 42.88 42.94 43.08 romulusm 52.37 52.83 53.08 T:isapk128v20 53.48 53.51 53.53 T:tinyjambu128v2 60.96 60.98 61.01 T:tinyjambu192v2 63.40 63.42 63.45 T:tinyjambu256v2 86.97 87.03 87.14 romulust 123.70 124.46 125.42 T:elephant200v2 131.15 131.39 132.01 T:isapxv20 4260.17 4268.67 4273.65 T:elephant176v2 4418.16 4423.96 4432.43 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.75 0.75 0.77 T:aes128gcmv1 0.85 0.85 0.86 aes256gcmv1 6.44 6.45 6.46 ascon128av12 9.70 9.74 9.76 ascon80pqv12 9.70 9.77 9.82 ascon128v12 10.14 10.19 10.22 T:xoodyakround3 12.34 12.37 12.43 T:schwaemm256128v2 13.23 13.28 13.32 ascon128abi32v12 16.33 16.38 16.44 T:schwaemm192192v2 17.27 17.34 17.43 T:schwaemm256256v2 18.21 18.23 18.27 T:schwaemm128128v2 19.26 19.29 19.33 ascon128bi32v12 19.54 19.58 19.66 T:isapa128v20 22.77 22.80 22.82 T:grain128aeadv2 26.14 26.20 26.25 T:isapa128av20 31.12 31.15 31.17 romulusn 32.22 32.32 32.68 T:isapk128av20 32.98 33.01 33.03 T:giftcofb128v1 40.53 40.59 40.71 T:isapk128v20 42.86 42.89 43.00 romulusm 44.51 44.58 44.67 romulust 53.49 53.54 53.62 T:tinyjambu128v2 60.96 60.98 61.10 T:tinyjambu192v2 63.31 63.34 63.44 T:tinyjambu256v2 98.78 98.86 98.95 T:isapxv20 125.10 125.80 126.87 T:elephant200v2 4261.05 4266.31 4275.95 T:elephant176v2 4421.38 4427.53 4435.52 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.29 0.31 0.32 T:aes128gcmv1 0.28? 0.31? 0.32? aes256gcmv1 6.43 6.45 6.47 ascon128av12 7.07 7.16 7.20 T:xoodyakround3 9.68 9.72 9.75 ascon80pqv12 9.73 9.76 9.78 ascon128v12 12.18 12.25 12.31 T:schwaemm256128v2 13.31 13.34 13.38 ascon128abi32v12 16.26 16.32 16.39 T:schwaemm192192v2 17.17 17.33 17.37 T:schwaemm256256v2 18.15 18.17 18.20 T:schwaemm128128v2 19.37 19.49 19.87 ascon128bi32v12 19.56 19.62 19.73 T:isapa128v20 22.97 23.08 23.12 T:grain128aeadv2 23.45 23.49 23.54 romulusn 23.46 23.50 23.57 romulusm 26.02 26.13 26.32 T:isapa128av20 32.26 32.35 32.46 T:isapk128av20 32.94 32.97 33.08 T:giftcofb128v1 40.36 40.46 40.53 T:isapk128v20 41.37 41.41 41.46 T:tinyjambu128v2 42.58 42.60 42.63 T:tinyjambu256v2 43.83 43.86 43.95 T:tinyjambu192v2 44.45 44.54 44.62 romulust 81.74 81.87 83.27 T:elephant200v2 96.63 98.29 100.07 T:isapxv20 2816.57 2817.82 2827.75 T:elephant176v2 2945.41 2949.74 2954.31 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.29 0.30 0.32 T:aes128gcmv1 0.30 0.31 0.33 aes256gcmv1 6.44 6.46 6.49 ascon128av12 7.11 7.17 7.21 T:xoodyakround3 9.74 9.76 9.79 ascon128v12 9.72 9.79 9.83 ascon80pqv12 12.18 12.25 12.30 T:schwaemm256128v2 13.32 13.38 13.41 ascon128abi32v12 16.25 16.34 16.54 T:schwaemm192192v2 17.20 17.26 17.36 T:schwaemm256256v2 18.12 18.16 18.21 T:schwaemm128128v2 19.32 19.38 19.50 ascon128bi32v12 19.59 19.66 19.73 T:isapa128v20 23.03 23.12 23.18 T:grain128aeadv2 23.45 23.49 23.74 romulusm 23.45 23.50 23.53 romulusn 25.99 26.03 26.11 T:isapa128av20 32.22 32.30 32.41 T:isapk128av20 32.90 32.95 33.00 T:giftcofb128v1 40.41 40.50 40.54 T:isapk128v20 41.35 41.39 41.42 T:tinyjambu128v2 42.73 42.78 42.82 T:tinyjambu256v2 43.83 43.87 43.92 T:tinyjambu192v2 44.46 44.52 44.73 romulust 83.27 83.74 84.15 T:elephant200v2 98.69 98.81 98.93 T:isapxv20 2815.73 2820.05 2828.84 T:elephant176v2 2947.53 2949.05 2955.53 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.30 0.31 0.32 T:aes128gcmv1 0.30 0.31 0.33 aes256gcmv1 6.44 6.46 6.49 ascon128av12 7.09 7.14 7.21 T:xoodyakround3 9.76 9.78 9.81 ascon128v12 9.74 9.79 9.82 ascon80pqv12 12.21 12.26 12.30 T:schwaemm256128v2 13.28 13.33 13.40 ascon128abi32v12 16.28 16.34 16.36 T:schwaemm192192v2 17.20 17.32 17.39 T:schwaemm256256v2 18.12 18.15 18.18 T:schwaemm128128v2 19.36 19.40 19.49 ascon128bi32v12 19.51 19.58 19.67 T:isapa128v20 22.97 23.03 23.09 T:grain128aeadv2 23.43 23.49 23.52 romulusn 23.41 23.50 23.57 romulusm 25.99 26.05 26.13 T:isapa128av20 32.28 32.36 32.43 T:isapk128av20 32.94 33.03 33.09 T:giftcofb128v1 40.41 40.50 40.56 T:isapk128v20 41.34 41.38 41.46 T:tinyjambu128v2 42.56 42.59 42.68 T:tinyjambu256v2 43.89 43.99 44.44 T:tinyjambu192v2 44.44 44.53 44.59 romulust 81.38 83.59 83.84 T:elephant200v2 98.83 98.92 99.05 T:isapxv20 2818.37 2823.73 2832.34 T:elephant176v2 2946.15 2948.33 2954.58 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 0.97 0.98 0.98 T:aes128gcmv1 1.05 1.05 1.06 aes256gcmv1 6.64 6.65 6.66 ascon128av12 9.91 9.93 9.97 ascon80pqv12 9.86 9.96 9.99 ascon128v12 10.29 10.31 10.34 T:xoodyakround3 12.74 12.78 12.82 T:schwaemm256128v2 13.59 13.64 13.70 ascon128abi32v12 16.80 16.81 16.84 T:schwaemm192192v2 17.80 17.84 17.86 T:schwaemm256256v2 18.43 18.45 18.48 T:schwaemm128128v2 19.61 19.64 19.67 ascon128bi32v12 23.47 23.49 23.53 T:grain128aeadv2 31.39 31.42 31.44 romulusn 33.23 33.30 33.32 T:giftcofb128v1 34.77 34.84 34.87 T:isapa128av20 42.88 42.95 43.01 T:isapa128v20 43.17 43.21 43.26 romulusm 45.67 45.83 45.85 T:isapk128av20 54.10 54.12 54.21 T:tinyjambu128v2 61.59 61.62 61.68 T:tinyjambu192v2 63.86 63.87 63.88 T:tinyjambu256v2 88.31 88.38 88.49 romulust 91.46 91.68 91.75 T:isapk128v20 127.55 128.33 129.05 T:elephant200v2 217.16 217.28 217.45 T:isapxv20 4291.27 4302.56 4315.01 T:elephant176v2 4469.05 4471.18 4473.27 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 0.88 0.89 0.91 T:aes128gcmv1 0.99 0.99 1.00 aes256gcmv1 6.60 6.62 6.64 ascon128av12 9.82 9.85 9.89 ascon80pqv12 9.87 9.93 9.99 ascon128v12 10.24 10.26 10.29 T:xoodyakround3 12.73 12.77 12.80 T:schwaemm256128v2 13.57 13.59 13.63 ascon128abi32v12 16.71 16.76 16.80 T:schwaemm192192v2 17.73 17.80 17.85 T:schwaemm256256v2 18.44 18.45 18.50 T:schwaemm128128v2 19.59 19.63 19.66 ascon128bi32v12 23.15 23.18 23.20 T:grain128aeadv2 31.43 31.47 31.53 romulusn 33.27 33.31 33.41 T:giftcofb128v1 34.78 34.83 34.87 T:isapa128av20 42.85 42.91 42.95 T:isapa128v20 43.26 43.31 43.35 romulusm 45.73 45.79 45.84 T:isapk128av20 54.01 54.02 54.03 T:tinyjambu128v2 61.48 61.50 61.54 T:tinyjambu192v2 63.97 63.98 64.03 T:tinyjambu256v2 88.34 88.42 88.45 romulust 91.40 91.47 91.68 T:isapk128v20 126.35 128.07 128.39 T:elephant200v2 219.75 219.79 219.96 T:isapxv20 4292.03 4298.94 4304.51 T:elephant176v2 4469.26 4470.32 4472.80 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 0.88 0.89 0.91 T:aes128gcmv1 0.99 0.99 1.00 aes256gcmv1 6.59 6.61 6.63 ascon128av12 9.85 9.87 9.88 ascon80pqv12 9.85 9.88 9.94 ascon128v12 10.25 10.28 10.30 T:xoodyakround3 12.71 12.73 12.77 T:schwaemm256128v2 13.55 13.59 13.61 ascon128abi32v12 16.75 16.80 16.87 T:schwaemm192192v2 17.74 17.78 17.80 T:schwaemm256256v2 18.43 18.46 18.49 T:schwaemm128128v2 19.59 19.62 19.65 ascon128bi32v12 23.11 23.15 23.18 T:grain128aeadv2 26.37 26.40 26.51 T:isapa128v20 27.33 27.37 27.41 T:isapa128av20 31.46 31.49 31.54 romulusn 33.26 33.33 33.37 T:giftcofb128v1 35.63 35.77 35.85 T:isapk128av20 43.23 43.26 43.29 romulusm 45.85 45.88 45.92 romulust 53.99 54.01 54.12 T:tinyjambu128v2 61.09 61.11 61.13 T:isapk128v20 61.50 61.51 61.65 T:tinyjambu192v2 63.87 63.89 63.90 T:tinyjambu256v2 126.74 127.73 127.93 T:elephant200v2 144.06 144.50 144.64 T:isapxv20 4291.92 4294.45 4304.38 T:elephant176v2 4468.60 4472.02 4482.56 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 5.64 5.69 5.80 T:aes128gcmv1 5.89 5.95 6.13 aes256gcmv1 9.89 10.07 10.27 ascon128av12 12.88 12.95 13.10 ascon128v12 12.94 13.06 13.30 ascon80pqv12 14.77 14.89 15.29 T:xoodyakround3 20.34 20.48 20.79 ascon128abi32v12 20.69 21.02 21.43 T:schwaemm256128v2 23.66 23.77 24.24 T:schwaemm128128v2 26.50 26.76 27.12 ascon128bi32v12 27.23 27.48 27.96 T:schwaemm192192v2 28.41 28.80 28.95 T:schwaemm256256v2 31.26 31.40 31.58 T:grain128aeadv2 37.77 38.01 38.25 romulusn 39.46 39.55 39.66 T:giftcofb128v1 50.45 50.59 50.87 romulusm 65.48 65.82 66.73 T:tinyjambu128v2 74.03 74.26 74.53 T:tinyjambu192v2 76.87 77.23 77.69 T:tinyjambu256v2 81.80 81.98 82.29 T:isapa128av20 117.78 117.91 118.33 romulust 157.30 157.98 161.16 T:isapk128av20 176.65 180.67 181.79 T:elephant200v2 350.02 350.90 352.19 T:isapa128v20 967.95 968.98 979.95 T:isapk128v20 2191.30 2192.26 2193.93 T:isapxv20 5336.23 5339.54 5350.16 T:elephant176v2 5977.36 5979.61 6012.68 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 5.42 5.48 5.55 T:aes128gcmv1 5.47 5.51 5.55 aes256gcmv1 9.91 10.00 10.20 ascon128av12 12.89 13.00 13.09 ascon128v12 12.93 13.09 13.39 ascon80pqv12 14.70 14.86 14.98 T:xoodyakround3 20.23 20.52 20.73 ascon128abi32v12 20.71 20.99 21.63 T:schwaemm256128v2 23.71 23.77 24.21 T:schwaemm128128v2 26.62 26.83 27.08 ascon128bi32v12 27.29 27.46 27.83 T:schwaemm192192v2 28.06 28.77 29.40 T:schwaemm256256v2 31.21 31.29 31.38 T:grain128aeadv2 38.39 38.49 38.63 romulusn 39.60 39.76 40.00 T:giftcofb128v1 52.60 52.82 53.02 romulusm 65.62 65.92 66.39 T:tinyjambu128v2 74.16 74.42 74.71 T:tinyjambu192v2 76.58 76.91 77.26 T:tinyjambu256v2 81.84 82.09 82.35 T:isapa128av20 117.65 118.44 119.05 romulust 157.28 157.71 158.59 T:isapk128av20 176.30 179.95 180.47 T:elephant200v2 350.55 351.49 352.10 T:isapa128v20 967.96 969.08 976.85 T:isapk128v20 2225.23 2228.52 2229.22 T:isapxv20 5334.09 5336.46 5343.90 T:elephant176v2 5976.43 5978.79 6009.52 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 5.41 5.45 5.53 T:aes128gcmv1 5.45 5.54 5.66 aes256gcmv1 9.91 9.99 10.05 ascon128av12 12.82 12.89 13.08 ascon128v12 12.93 13.06 13.25 ascon80pqv12 14.77 14.87 15.27 T:xoodyakround3 20.34 20.58 20.74 ascon128abi32v12 20.52 21.12 21.27 T:schwaemm256128v2 23.68 23.83 24.02 T:schwaemm128128v2 26.79 27.00 27.12 ascon128bi32v12 27.30 27.57 28.02 T:schwaemm192192v2 27.98 28.17 28.58 T:schwaemm256256v2 31.14 31.23 31.38 T:grain128aeadv2 38.34 38.47 38.73 romulusn 39.74 39.77 39.90 T:giftcofb128v1 52.55 52.68 52.87 romulusm 54.26 54.59 54.97 T:isapa128av20 65.62 65.91 66.54 T:tinyjambu128v2 74.23 74.38 74.68 T:tinyjambu192v2 74.63 75.27 75.57 romulust 76.72 77.12 77.32 T:tinyjambu256v2 101.86 102.11 102.91 T:isapk128av20 177.53 178.39 179.03 T:elephant200v2 182.99 183.29 183.97 T:isapa128v20 516.41 516.77 517.31 T:isapk128v20 1165.32 1166.02 1166.77 T:isapxv20 5340.13 5372.21 5467.98 T:elephant176v2 5973.48 5977.23 5979.30 T:elephant160v2

amd64; Golden Cove (906a4-40); 2022 Intel Core i3-1215U, P cores; 2 x 1600MHz; alder2,1f626960,5600000, supercop-20240107

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 0.50? 0.53? 0.56? T:aes128gcmv1 0.62 0.63 0.67 T:aes256gcmv1 1.52 1.54 1.56 aes256gcmv1 3.85 3.94 4.04 aes128gcmv1 6.53 6.57 6.60 ascon128av12 9.83 9.88 9.91 ascon128v12 9.68 9.98 10.06 ascon80pqv12 13.02 13.05 13.11 ascon128abi32v12 13.42 13.47 13.50 T:schwaemm256128v2 15.25 15.33 15.38 T:xoodyakround3 17.69 17.78 17.87 T:schwaemm192192v2 18.88 18.93 19.03 T:schwaemm256256v2 19.84 19.89 19.93 T:schwaemm128128v2 19.90 19.98 20.01 ascon128bi32v12 24.32 24.39 24.45 T:grain128aeadv2 38.45 38.50 38.54 romulusn 39.11 39.33 39.44 T:isapa128av20 38.97 39.52 39.82 T:isapa128v20 39.79 39.84 39.89 T:giftcofb128v1 49.21 50.27 50.65 T:isapk128av20 54.99 55.05 55.09 T:tinyjambu128v2 61.70 61.79 61.83 romulusm 66.49 66.68 66.78 T:tinyjambu192v2 66.93 67.67 68.38 T:isapk128v20 71.09 71.21 71.30 T:tinyjambu256v2 110.37 110.87 111.33 T:elephant200v2 119.33 119.43 119.67 romulust 119.84 120.41 120.95 T:isapxv20 5774.24 5799.66 5811.41 T:elephant176v2 5887.66 5892.35 5894.61 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 0.49? 0.52? 0.55? T:aes128gcmv1 0.57 0.60 0.63 T:aes256gcmv1 1.40 1.41 1.43 aes256gcmv1 3.79 3.87 3.95 aes128gcmv1 6.57 6.63 6.67 ascon128av12 9.75 9.79 9.82 ascon128v12 9.72 9.82 10.00 ascon80pqv12 13.01 13.05 13.11 ascon128abi32v12 13.38 13.41 13.46 T:schwaemm256128v2 15.10 15.20 15.25 T:xoodyakround3 17.64 17.68 17.74 T:schwaemm192192v2 18.89 19.12 19.63 T:schwaemm256256v2 19.79 19.83 19.87 T:schwaemm128128v2 20.01 20.05 20.13 ascon128bi32v12 23.65 23.70 23.74 T:grain128aeadv2 38.58 38.62 38.63 romulusn 39.35 39.64 39.97 T:isapa128v20 39.68 39.73 39.83 T:isapa128av20 39.80 39.84 39.87 T:giftcofb128v1 49.31 49.77 50.40 T:isapk128av20 54.83 54.91 54.96 T:tinyjambu128v2 61.73 61.85 62.02 romulusm 66.51 66.59 66.66 T:tinyjambu192v2 67.17 68.11 68.91 T:isapk128v20 70.75 71.02 71.37 T:tinyjambu256v2 110.52 110.73 110.92 T:elephant200v2 119.24 119.37 119.55 romulust 119.83 120.31 120.65 T:isapxv20 5775.67 5803.50 5816.53 T:elephant176v2 5888.76 5890.42 5893.94 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 0.50 0.52 0.53 T:aes128gcmv1 0.60 0.61 0.65 T:aes256gcmv1 1.40 1.42 1.43 aes256gcmv1 1.55 1.60 1.64 aes128gcmv1 6.58 6.63 6.73 ascon128av12 9.72 9.77 10.00 ascon80pqv12 9.75 9.78 9.84 ascon128v12 13.06 13.12 13.13 ascon128abi32v12 13.41 13.45 13.49 T:schwaemm256128v2 15.12 15.18 15.25 T:xoodyakround3 17.62 17.65 17.76 T:schwaemm192192v2 18.93 19.11 20.38 T:schwaemm256256v2 19.45 19.50 19.55 T:isapa128v20 19.78 19.81 19.84 T:schwaemm128128v2 19.96 20.05 20.16 ascon128bi32v12 23.67 23.71 23.76 T:grain128aeadv2 26.14 26.34 26.38 T:isapa128av20 33.10 33.38 34.44 T:isapk128av20 38.55 38.62 38.66 romulusn 39.81 39.85 39.89 T:giftcofb128v1 41.29 41.44 41.53 romulust 42.00 42.40 43.36 T:isapk128v20 54.86 54.92 55.00 T:tinyjambu128v2 61.76 61.93 62.00 romulusm 66.45 66.52 66.59 T:tinyjambu192v2 70.84 70.99 71.16 T:tinyjambu256v2 72.12 72.35 72.60 T:isapxv20 110.51 111.12 111.37 T:elephant200v2 5773.16 5791.97 5807.95 T:elephant176v2 5889.61 5891.95 5895.48 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.36 0.38 0.39 T:aes128gcmv1 0.40 0.43 0.44 T:aes256gcmv1 0.91 0.92 0.93 aes256gcmv1 2.68 2.73 2.78 aes128gcmv1 6.48 6.58 6.61 ascon128av12 9.58 9.66 9.76 ascon80pqv12 9.81 9.82 9.85 ascon128v12 11.44 11.48 11.54 T:xoodyakround3 13.25 13.33 13.38 ascon128abi32v12 13.38 13.42 13.47 T:schwaemm256128v2 17.65 17.74 17.80 T:schwaemm192192v2 18.88 19.10 20.42 T:schwaemm256256v2 19.83 19.85 19.88 T:schwaemm128128v2 20.15 20.21 20.24 ascon128bi32v12 24.29 24.33 24.36 T:grain128aeadv2 29.37 29.48 29.65 T:isapa128v20 30.85 30.89 30.91 romulusn 32.45 32.52 32.82 T:isapa128av20 39.80 39.84 39.88 T:giftcofb128v1 41.94 42.24 42.36 T:isapk128av20 42.48 42.54 42.57 romulusm 45.03 45.06 45.10 T:tinyjambu128v2 52.05 52.11 52.22 T:tinyjambu192v2 53.80 53.83 53.93 T:tinyjambu256v2 54.00 54.46 55.29 T:isapk128v20 80.35 80.45 80.50 romulust 82.77 83.19 83.58 T:elephant200v2 96.46 96.95 97.29 T:isapxv20 4326.05 4337.54 4348.62 T:elephant176v2 4416.23 4418.28 4419.31 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.34? 0.37? 0.40? T:aes128gcmv1 0.38 0.41 0.42 T:aes256gcmv1 0.85 0.86 0.86 aes256gcmv1 2.63 2.69 2.74 aes128gcmv1 6.51 6.54 6.58 ascon128av12 9.73 9.77 9.79 ascon128v12 9.60 9.77 9.88 ascon80pqv12 11.37 11.39 11.43 T:xoodyakround3 13.29 13.33 13.36 ascon128abi32v12 13.32 13.34 13.39 T:schwaemm256128v2 17.68 17.71 17.76 T:schwaemm192192v2 18.86 19.01 19.04 T:schwaemm256256v2 19.79 19.82 19.86 T:schwaemm128128v2 20.05 20.10 20.23 ascon128bi32v12 23.87 23.92 24.03 T:grain128aeadv2 29.32 29.42 29.68 T:isapa128v20 30.89 30.94 30.96 romulusn 32.88 32.99 33.08 T:isapa128av20 39.78 39.81 39.82 T:giftcofb128v1 41.62 41.92 42.32 T:isapk128av20 42.47 42.54 42.61 romulusm 44.93 45.00 45.04 T:tinyjambu128v2 52.04 52.08 52.15 T:tinyjambu192v2 53.66 53.87 53.93 T:tinyjambu256v2 54.22 55.11 55.89 T:isapk128v20 80.34 80.43 80.54 romulust 83.13 83.33 83.52 T:elephant200v2 96.28 96.44 96.65 T:isapxv20 4329.28 4337.38 4348.08 T:elephant176v2 4415.98 4418.70 4420.43 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.36 0.37 0.39 T:aes128gcmv1 0.41 0.42 0.43 T:aes256gcmv1 0.85 0.86 0.86 aes256gcmv1 1.54 1.57 1.61 aes128gcmv1 6.54 6.59 6.65 ascon128av12 9.63 9.67 9.77 ascon80pqv12 9.75 9.78 9.81 ascon128v12 11.39 11.42 11.45 T:xoodyakround3 13.31 13.34 13.37 T:schwaemm256128v2 13.31 13.36 13.43 ascon128abi32v12 17.61 17.65 17.71 T:schwaemm192192v2 19.44 19.49 19.54 T:isapa128v20 19.78 19.83 19.88 T:schwaemm128128v2 20.01 20.05 20.08 ascon128bi32v12 19.30 20.57 21.15 T:schwaemm256256v2 23.88 23.91 24.04 T:grain128aeadv2 26.29 26.34 26.40 T:isapa128av20 30.89 30.92 30.96 romulusn 33.44 33.59 33.85 T:isapk128av20 39.78 39.81 39.84 T:giftcofb128v1 41.24 41.39 41.44 romulust 41.90 42.16 42.33 T:isapk128v20 42.56 42.61 42.67 romulusm 44.91 44.95 45.00 T:tinyjambu128v2 51.99 52.08 52.14 T:tinyjambu192v2 53.73 53.86 54.04 T:tinyjambu256v2 72.26 72.36 72.54 T:isapxv20 82.89 83.03 83.45 T:elephant200v2 4329.63 4335.94 4345.95 T:elephant176v2 4416.63 4418.32 4419.49 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.21? 0.23? 0.27? T:aes256gcmv1 0.21? 0.23? 0.26? T:aes128gcmv1 0.29 0.31 0.32 aes256gcmv1 1.50 1.53 1.58 aes128gcmv1 6.38 6.51 6.61 ascon128av12 7.60 7.65 7.70 T:xoodyakround3 9.71 9.74 9.79 ascon128v12 9.60 9.90 10.31 ascon80pqv12 13.26 13.32 13.36 T:schwaemm256128v2 13.39 13.51 13.61 ascon128abi32v12 17.57 17.62 17.73 T:schwaemm192192v2 18.87? 19.00? 21.12? T:schwaemm256256v2 19.45 19.54 19.57 T:isapa128v20 19.78 19.80 19.84 T:schwaemm128128v2 20.19 20.27 20.48 ascon128bi32v12 23.21 23.25 23.29 romulusn 23.22 23.28 23.32 romulusm 24.10 24.15 24.33 T:grain128aeadv2 25.99 26.17 26.28 T:isapa128av20 32.93 33.66 33.99 T:isapk128av20 34.83 34.87 34.95 T:tinyjambu128v2 36.28 36.36 36.45 T:tinyjambu256v2 37.65 37.77 37.84 T:tinyjambu192v2 39.77 39.82 39.90 T:giftcofb128v1 41.31 41.37 41.40 romulust 40.88 41.60 42.40 T:isapk128v20 55.69 55.86 56.07 T:elephant200v2 72.29 72.50 73.56 T:isapxv20 2861.64 2876.06 2884.85 T:elephant176v2 2942.64 2944.78 2946.14 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.21 0.22 0.23 T:aes256gcmv1 0.22 0.22 0.24 T:aes128gcmv1 0.29 0.30 0.32 aes256gcmv1 1.44 1.52 1.56 aes128gcmv1 6.39 6.48 6.58 ascon128av12 7.57 7.65 7.68 T:xoodyakround3 9.62 9.69 9.81 ascon80pqv12 9.69 9.72 9.77 ascon128v12 13.27 13.30 13.38 T:schwaemm256128v2 13.51 13.59 13.65 ascon128abi32v12 17.63 17.70 17.73 T:schwaemm192192v2 19.43 19.48 19.54 T:isapa128v20 19.77 19.81 19.85 T:schwaemm128128v2 20.07 20.15 20.21 ascon128bi32v12 20.06 20.41 20.55 T:schwaemm256256v2 23.19 23.25 23.28 romulusn 23.26 23.33 23.38 romulusm 24.09 24.22 24.26 T:grain128aeadv2 26.20 26.29 26.38 T:isapa128av20 32.60 33.19 33.97 T:isapk128av20 34.77 34.81 34.88 T:tinyjambu128v2 36.27 36.32 36.39 T:tinyjambu256v2 37.52 37.59 37.66 T:tinyjambu192v2 39.73 39.80 39.87 T:giftcofb128v1 41.19 41.25 41.37 romulust 40.41 41.70 42.17 T:isapk128v20 55.90 56.04 56.11 T:elephant200v2 72.33 72.52 72.78 T:isapxv20 2857.82 2867.94 2877.93 T:elephant176v2 2942.44 2943.53 2945.34 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.21? 0.22? 0.24? T:aes128gcmv1 0.21? 0.23? 0.24? T:aes256gcmv1 0.29 0.30 0.31 aes256gcmv1 1.50 1.53 1.58 aes128gcmv1 6.44 6.54 6.61 ascon128av12 7.57 7.62 7.65 T:xoodyakround3 9.55 9.65 9.73 ascon80pqv12 9.69 9.74 9.77 ascon128v12 13.24 13.28 13.33 T:schwaemm256128v2 13.52 13.61 13.67 ascon128abi32v12 17.59 17.63 17.70 T:schwaemm192192v2 18.84 18.92 19.28 T:schwaemm256256v2 19.38 19.48 19.58 T:isapa128v20 19.77 19.81 19.86 T:schwaemm128128v2 20.01 20.06 20.21 ascon128bi32v12 23.19 23.23 23.28 romulusn 23.20 23.26 23.34 romulusm 24.05 24.08 24.12 T:grain128aeadv2 26.24 26.35 26.43 T:isapa128av20 32.91 33.27 33.93 T:isapk128av20 34.84 34.88 34.94 T:tinyjambu128v2 36.29 36.34 36.53 T:tinyjambu256v2 37.50 37.57 37.62 T:tinyjambu192v2 39.76 39.82 39.89 T:giftcofb128v1 41.23 41.31 41.41 romulust 40.64 41.54 42.87 T:isapk128v20 55.60 55.70 55.77 T:elephant200v2 72.27 72.50 72.83 T:isapxv20 2846.97 2861.92 2876.41 T:elephant176v2 2941.91 2943.81 2945.32 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 0.73 0.73 0.74 T:aes128gcmv1 0.78 0.79 0.79 T:aes256gcmv1 1.06 1.06 1.06 aes256gcmv1 2.80 2.86 2.89 aes128gcmv1 6.64 6.69 6.71 ascon128av12 9.72 9.77 9.90 ascon80pqv12 9.91 9.94 9.96 ascon128v12 11.59 11.60 11.62 T:xoodyakround3 13.59 13.61 13.69 ascon128abi32v12 13.74 13.77 13.81 T:schwaemm256128v2 18.05 18.10 18.15 T:schwaemm192192v2 19.52 19.55 19.99 T:schwaemm256256v2 20.11 20.12 20.15 T:schwaemm128128v2 20.42 20.47 20.55 ascon128bi32v12 24.52 24.57 24.64 T:grain128aeadv2 31.12 31.14 31.17 romulusn 36.17 36.26 36.48 T:isapa128av20 40.12 40.14 40.17 T:giftcofb128v1 42.81 42.89 42.91 romulusm 42.63 42.97 43.03 T:isapa128v20 45.51 45.53 45.56 T:tinyjambu128v2 46.75 46.97 47.32 T:isapk128av20 52.70 52.71 52.76 T:tinyjambu192v2 54.30 54.37 54.42 T:tinyjambu256v2 81.58 81.62 81.67 romulust 84.46 84.67 84.75 T:elephant200v2 94.06 94.38 94.90 T:isapk128v20 159.54 160.06 160.28 T:isapxv20 4355.05 4360.72 4376.38 T:elephant176v2 4466.11 4467.92 4468.53 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 0.72 0.73 0.74 T:aes128gcmv1 0.78 0.78 0.80 T:aes256gcmv1 1.00 1.01 1.03 aes256gcmv1 2.86 2.88 2.91 aes128gcmv1 6.68 6.72 6.73 ascon128av12 9.81 9.84 9.88 ascon80pqv12 9.88 9.90 9.93 ascon128v12 11.54 11.57 11.60 T:xoodyakround3 13.57 13.64 13.69 ascon128abi32v12 13.72 13.75 13.77 T:schwaemm256128v2 18.08 18.12 18.18 T:schwaemm192192v2 19.54 19.59 20.70 T:schwaemm256256v2 20.07 20.09 20.11 T:schwaemm128128v2 20.35 20.42 20.47 ascon128bi32v12 24.27 24.35 24.38 T:grain128aeadv2 31.23 31.24 31.26 romulusn 36.68 36.71 36.76 T:isapa128av20 40.15 40.16 40.18 T:giftcofb128v1 42.70 42.93 43.04 T:isapa128v20 42.90 42.97 43.03 romulusm 45.38 45.40 45.43 T:tinyjambu128v2 46.67 47.04 47.22 T:isapk128av20 52.61 52.65 52.69 T:tinyjambu192v2 54.38 54.42 54.49 T:tinyjambu256v2 81.53 81.59 81.63 romulust 84.73 84.76 84.85 T:elephant200v2 93.97 94.16 94.54 T:isapk128v20 160.11 160.43 161.89 T:isapxv20 4363.25 4378.86 4384.88 T:elephant176v2 4464.69 4467.33 4469.24 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 0.73 0.73 0.74 T:aes128gcmv1 0.79 0.79 0.80 T:aes256gcmv1 1.00 1.01 1.01 aes256gcmv1 1.69 1.71 1.74 aes128gcmv1 6.72 6.74 6.77 ascon128av12 9.86 9.90 9.92 ascon80pqv12 9.88 9.91 9.92 ascon128v12 11.55 11.56 11.63 T:xoodyakround3 13.59 13.65 13.68 ascon128abi32v12 13.71 13.73 13.77 T:schwaemm256128v2 18.09 18.11 18.14 T:schwaemm192192v2 19.51 19.58 21.04 T:schwaemm256256v2 20.06 20.09 20.12 T:schwaemm128128v2 20.36 20.40 20.42 ascon128bi32v12 24.26 24.28 24.31 T:grain128aeadv2 26.22 26.25 26.28 T:isapa128v20 28.17 28.33 28.38 T:isapa128av20 31.19 31.21 31.25 romulusn 36.47 36.58 36.92 T:isapk128av20 40.12 40.15 40.19 T:giftcofb128v1 42.53 42.58 42.65 romulust 42.90 42.97 43.02 romulusm 45.36 45.37 45.38 T:tinyjambu128v2 52.56 52.64 52.74 T:tinyjambu192v2 54.18 54.32 54.35 T:tinyjambu256v2 62.21 62.51 62.71 T:isapk128v20 84.27 84.42 84.88 T:elephant200v2 104.76 104.93 105.12 T:isapxv20 4370.03 4379.69 4383.61 T:elephant176v2 4463.36 4467.95 4468.83 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 5.37 5.50 5.88 aes128gcmv1 5.61 5.67 5.76 aes256gcmv1 8.90 9.26 9.46 T:aes128gcmv1 9.23 9.45 9.80 T:aes256gcmv1 10.43 10.47 10.62 ascon128av12 12.72 12.86 13.20 ascon80pqv12 12.81 12.91 13.13 ascon128v12 16.73 17.00 17.36 T:xoodyakround3 20.09 20.20 20.45 ascon128abi32v12 22.40 22.55 22.93 T:schwaemm256128v2 25.57 25.70 25.92 T:schwaemm128128v2 27.23 27.48 27.73 ascon128bi32v12 29.04 29.37 29.72 T:schwaemm192192v2 30.91 31.20 31.32 T:schwaemm256256v2 32.44 32.56 32.82 T:grain128aeadv2 37.55 37.65 37.84 romulusn 47.34 47.40 47.59 T:giftcofb128v1 50.09 50.22 50.45 romulusm 55.77 56.00 56.48 T:tinyjambu128v2 64.20 64.77 65.02 T:tinyjambu192v2 65.73 66.25 66.98 T:tinyjambu256v2 108.10 108.41 108.56 romulust 118.66 119.13 119.95 T:isapa128av20 118.83 119.31 119.55 T:elephant200v2 150.56 151.32 151.87 T:isapk128av20 348.84 349.33 349.73 T:isapa128v20 982.64 994.36 999.28 T:isapk128v20 1595.76 1598.55 1603.76 T:isapxv20 5450.50 5465.41 5489.15 T:elephant176v2 5980.66 5982.71 5984.94 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 5.82 5.88 5.96 aes256gcmv1 6.79 7.27 7.54 aes128gcmv1 9.01 9.12 9.46 T:aes128gcmv1 9.40 9.45 9.90 T:aes256gcmv1 10.18 10.42 10.57 ascon128av12 12.90 12.95 13.07 ascon80pqv12 12.91 13.00 13.12 ascon128v12 16.64 16.93 17.21 T:xoodyakround3 20.20 20.47 20.77 ascon128abi32v12 22.23 22.36 22.73 T:schwaemm256128v2 25.46 25.55 25.72 T:schwaemm128128v2 27.05 27.24 27.58 ascon128bi32v12 29.41 29.66 30.26 T:schwaemm192192v2 32.37 32.76 32.90 T:grain128aeadv2 33.33 33.66 33.97 T:schwaemm256256v2 37.94 38.06 38.14 romulusn 47.47 47.57 47.78 T:giftcofb128v1 52.06 52.21 52.40 romulusm 55.90 56.16 56.54 T:tinyjambu128v2 63.91 64.44 64.71 T:tinyjambu192v2 66.00 66.21 66.64 T:tinyjambu256v2 108.49 109.09 109.73 romulust 119.41 119.81 120.23 T:isapa128av20 119.68 120.48 120.65 T:elephant200v2 150.74 151.24 151.88 T:isapk128av20 349.05 349.66 350.49 T:isapa128v20 986.64 989.88 998.09 T:isapk128v20 1599.81 1601.71 1603.33 T:isapxv20 5406.92 5410.48 5417.93 T:elephant176v2 5976.94 5979.44 5988.31 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 4.81 4.95 5.24 aes128gcmv1 5.78 5.84 5.91 aes256gcmv1 9.02 9.07 9.23 T:aes128gcmv1 9.38 9.44 9.63 T:aes256gcmv1 10.13 10.20 10.37 ascon128av12 12.82 12.95 13.04 ascon80pqv12 12.88 13.03 13.15 ascon128v12 16.59 17.23 17.30 T:xoodyakround3 20.33 20.52 20.64 ascon128abi32v12 22.29 22.42 22.60 T:schwaemm256128v2 25.49 25.54 25.84 T:schwaemm128128v2 27.05 27.27 27.69 ascon128bi32v12 29.55 29.73 29.95 T:schwaemm192192v2 30.95 31.30 32.94 T:schwaemm256256v2 32.38 32.69 32.83 T:grain128aeadv2 37.81 38.02 38.14 romulusn 47.48 47.66 47.69 T:giftcofb128v1 51.80 52.10 52.34 romulusm 55.61 56.15 56.63 T:tinyjambu128v2 64.09 64.43 64.78 T:tinyjambu192v2 66.04 66.56 67.64 T:tinyjambu256v2 69.02 69.57 69.94 romulust 73.38 73.57 74.24 T:isapa128av20 98.92 99.36 99.59 T:isapk128av20 119.82 120.47 120.76 T:elephant200v2 181.99 182.29 182.91 T:isapa128v20 515.23 518.23 520.09 T:isapk128v20 836.22 839.32 841.69 T:isapxv20 5399.64 5405.66 5456.97 T:elephant176v2 5977.95 5980.67 5985.84 T:elephant160v2

amd64; Gracemont (906a4-20); 2022 Intel Core i3-1215U, E cores; 4 x 1600MHz; alder2,1f626960,3300000, supercop-20240107

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 0.51? 0.58? 0.62? T:aes128gcmv1 0.59? 0.66? 0.68? T:aes256gcmv1 1.38 1.40 1.41 aes256gcmv1 4.17 4.23 4.32 aes128gcmv1 6.17 6.19 6.47 ascon128av12 8.91 8.93 8.97 ascon80pqv12 8.92 8.94 8.96 ascon128v12 11.14 11.16 11.19 ascon128abi32v12 16.57 16.58 16.85 T:schwaemm256128v2 16.63 16.67 16.69 ascon128bi32v12 17.35 17.40 17.44 T:xoodyakround3 21.62 21.94 22.49 T:schwaemm256256v2 22.56 22.60 22.66 T:schwaemm192192v2 22.29 23.42 23.58 T:schwaemm128128v2 27.18 27.21 27.24 T:grain128aeadv2 36.54 36.57 36.62 romulusn 36.92 36.97 37.04 T:isapa128v20 38.79 38.83 38.86 T:giftcofb128v1 38.64 38.96 39.47 T:isapa128av20 51.37 51.41 51.46 T:tinyjambu128v2 59.31 59.42 59.55 T:tinyjambu192v2 60.21 60.34 60.48 romulusm 60.33 60.56 60.70 T:isapk128av20 61.32 62.37 62.63 T:tinyjambu256v2 79.73 80.05 80.41 T:isapk128v20 114.63 114.74 114.99 romulust 146.12 147.74 148.16 T:elephant200v2 135.13? 159.66? 184.22? T:isapxv20 6374.59 6421.01 6532.33 T:elephant176v2 7706.78 7776.92 7888.41 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 0.49? 0.58? 0.62? T:aes128gcmv1 0.52? 0.67? 0.71? T:aes256gcmv1 1.41 1.42 1.44 aes256gcmv1 4.21 4.28 4.35 aes128gcmv1 6.01 6.04 6.06 ascon128av12 8.90 8.92 8.94 ascon128v12 8.92 8.95 8.96 ascon80pqv12 11.09 11.11 11.14 ascon128abi32v12 16.59 16.63 16.85 T:schwaemm256128v2 16.77 16.79 16.81 ascon128bi32v12 16.96 17.48 17.59 T:xoodyakround3 21.53 21.89 22.52 T:schwaemm256256v2 22.58 22.62 22.67 T:schwaemm192192v2 22.30 23.43 23.60 T:schwaemm128128v2 26.96 27.09 27.18 T:grain128aeadv2 36.42 36.57 36.71 romulusn 36.88 36.98 37.08 T:isapa128v20 38.92 38.97 39.00 T:giftcofb128v1 38.59 38.97 39.52 T:isapa128av20 51.42 51.48 51.52 T:tinyjambu128v2 58.08 59.18 59.29 T:tinyjambu192v2 60.20 60.40 60.53 romulusm 60.42 60.57 60.65 T:isapk128av20 61.15 62.64 62.72 T:tinyjambu256v2 79.67 79.93 80.35 T:isapk128v20 114.66 114.98 115.05 romulust 145.77 147.39 147.82 T:elephant200v2 159.37 160.00 160.36 T:isapxv20 6374.38 6421.35 6532.37 T:elephant176v2 7772.18 7775.16 7888.27 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 0.49? 0.55? 0.60? T:aes128gcmv1 0.61? 0.68? 0.70? T:aes256gcmv1 1.40 1.41 1.42 aes256gcmv1 1.44 1.50 1.52 aes128gcmv1 6.04 6.06 6.07 ascon128av12 8.90 8.91 8.93 ascon128v12 8.92 8.93 8.96 ascon80pqv12 11.10 11.12 11.15 ascon128abi32v12 16.57 16.61 16.86 T:schwaemm256128v2 16.76 16.79 16.81 ascon128bi32v12 16.97 17.09 17.55 T:xoodyakround3 18.45 18.47 18.54 T:isapa128v20 21.54 21.90 22.49 T:schwaemm256256v2 22.61 22.62 22.67 T:schwaemm192192v2 22.25 23.60 23.68 T:schwaemm128128v2 25.35 25.50 26.01 T:isapa128av20 26.99 27.13 27.21 T:grain128aeadv2 36.42 36.62 36.73 romulusn 38.95 38.98 39.01 T:giftcofb128v1 39.18 39.24 39.28 romulust 40.01 40.11 40.24 T:isapk128av20 49.71 49.90 50.29 T:isapk128v20 51.42 51.47 51.54 T:tinyjambu128v2 58.13 59.11 59.29 T:tinyjambu192v2 60.26 60.38 60.52 romulusm 62.16 62.46 63.51 T:tinyjambu256v2 93.46 93.65 93.88 T:isapxv20 145.80 147.39 147.87 T:elephant200v2 6374.51 6421.02 6532.38 T:elephant176v2 7732.47 7774.93 7849.78 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.39? 0.43? 0.49? T:aes128gcmv1 0.42? 0.46? 0.49? T:aes256gcmv1 0.93 0.94 0.95 aes256gcmv1 2.82 2.85 2.89 aes128gcmv1 6.20 6.21 6.24 ascon128av12 8.87 8.89 8.91 ascon128v12 8.88 8.92 8.93 ascon80pqv12 11.02 11.05 11.07 ascon128abi32v12 13.27 13.29 13.32 T:xoodyakround3 16.52 16.56 16.99 T:schwaemm256128v2 16.59 16.61 16.63 ascon128bi32v12 21.60 21.90 22.43 T:schwaemm256256v2 22.41 22.55 22.60 T:schwaemm192192v2 23.23 23.30 23.69 T:schwaemm128128v2 27.24 27.27 27.32 T:grain128aeadv2 27.67 27.73 27.79 T:isapa128v20 29.86 29.89 29.91 romulusn 31.89 31.94 32.49 T:isapa128av20 38.80 38.82 38.84 T:giftcofb128v1 41.64 41.69 41.77 romulusm 42.22 42.25 42.27 T:tinyjambu128v2 46.46 46.57 46.66 T:tinyjambu192v2 47.37 47.80 47.96 T:tinyjambu256v2 50.24 50.31 50.40 T:isapk128av20 64.90 65.09 65.25 T:isapk128v20 76.98 77.01 77.03 romulust 109.73 111.31 111.58 T:elephant200v2 114.00? 126.52? 139.03? T:isapxv20 4796.09 4797.04 4805.48 T:elephant176v2 5805.95 5842.87 5915.79 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.37? 0.42? 0.48? T:aes128gcmv1 0.41? 0.48? 0.51? T:aes256gcmv1 0.91 0.94 0.95 aes256gcmv1 2.82 2.86 2.89 aes128gcmv1 5.99 6.01 6.03 ascon128av12 8.86 8.90 8.92 ascon128v12 8.90 8.91 8.92 ascon80pqv12 11.00 11.02 11.03 ascon128abi32v12 12.98 13.24 13.44 T:xoodyakround3 16.51 16.58 16.98 T:schwaemm256128v2 16.62 16.64 16.69 ascon128bi32v12 21.63 21.85 22.44 T:schwaemm256256v2 22.34 22.57 22.60 T:schwaemm192192v2 22.79 23.31 23.71 T:schwaemm128128v2 27.11 27.15 27.25 T:grain128aeadv2 27.69 27.72 27.79 T:isapa128v20 29.83 29.93 29.99 romulusn 31.89 31.94 32.49 T:isapa128av20 38.77 38.84 38.90 T:giftcofb128v1 41.54 41.75 41.80 romulusm 42.27 42.30 42.32 T:tinyjambu128v2 45.24 46.45 46.50 T:tinyjambu192v2 47.33 47.51 48.04 T:tinyjambu256v2 50.21 50.26 50.34 T:isapk128av20 64.95 65.08 65.24 T:isapk128v20 76.98 77.03 77.07 romulust 109.61 111.18 111.42 T:elephant200v2 125.98 126.64 127.29 T:isapxv20 4786.34 4796.19 4805.61 T:elephant176v2 5850.26 5900.48 5916.06 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.38? 0.41? 0.46? T:aes128gcmv1 0.44? 0.47? 0.49? T:aes256gcmv1 0.92 0.93 0.94 aes256gcmv1 1.44 1.46 1.48 aes128gcmv1 6.00 6.02 6.03 ascon128av12 8.86 8.88 8.92 ascon128v12 8.90 8.91 8.93 ascon80pqv12 11.00 11.02 11.07 ascon128abi32v12 12.98 13.03 13.16 T:xoodyakround3 16.53 16.58 16.99 T:schwaemm256128v2 16.62 16.64 16.66 ascon128bi32v12 18.44 18.47 18.49 T:isapa128v20 21.59 21.85 22.45 T:schwaemm256256v2 22.43 22.54 22.61 T:schwaemm192192v2 22.79 23.30 23.70 T:schwaemm128128v2 25.32 25.37 25.87 T:isapa128av20 27.12 27.16 27.23 T:grain128aeadv2 29.83 29.89 29.99 romulusn 38.78 38.82 38.84 T:giftcofb128v1 39.15 39.16 39.20 romulust 40.02 40.13 40.22 T:isapk128av20 41.56 41.60 41.72 romulusm 42.26 42.28 42.30 T:tinyjambu128v2 46.41 46.54 47.09 T:tinyjambu192v2 47.27 47.47 47.60 T:tinyjambu256v2 49.95 50.01 50.10 T:isapk128v20 93.14 93.60 93.87 T:isapxv20 109.50 111.17 111.34 T:elephant200v2 4786.28 4796.30 4805.49 T:elephant176v2 5850.35 5900.38 5915.89 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.20? 0.22? 0.27? T:aes128gcmv1 0.23? 0.26? 0.29? T:aes256gcmv1 0.46 0.48 0.49 aes256gcmv1 1.40 1.41 1.43 aes128gcmv1 5.95 5.98 6.21 ascon128av12 8.79 8.81 8.85 ascon128v12 8.86 8.87 8.89 ascon80pqv12 9.00 9.07 9.09 T:xoodyakround3 10.88 10.91 10.93 ascon128abi32v12 16.44 16.48 16.94 T:schwaemm256128v2 16.54 16.55 16.57 ascon128bi32v12 18.38 18.41 18.48 T:isapa128v20 21.56 21.83 22.36 T:schwaemm256256v2 22.35 22.44 22.48 T:schwaemm192192v2 22.89 22.97 23.05 romulusm 21.80 22.98 23.27 T:schwaemm128128v2 23.20 23.22 23.23 romulusn 25.30 25.52 26.02 T:isapa128av20 27.25 27.37 27.42 T:grain128aeadv2 31.34 32.38 32.43 T:tinyjambu256v2 33.09 33.12 33.16 T:tinyjambu128v2 33.59 33.66 34.94 T:tinyjambu192v2 38.73 38.77 38.85 T:giftcofb128v1 39.05 39.08 39.14 romulust 39.82 40.13 40.47 T:isapk128av20 50.04 50.51 50.66 T:isapk128v20 73.48 74.36 74.63 T:elephant200v2 68.37? 93.03? 118.26? T:isapxv20 3145.91 3162.62 3173.18 T:elephant176v2 3881.49 3897.28 3907.76 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.22? 0.26? 0.30? T:aes128gcmv1 0.24? 0.27? 0.30? T:aes256gcmv1 0.44 0.46 0.47 aes256gcmv1 1.43 1.43 1.47 aes128gcmv1 5.94 5.95 5.98 ascon128av12 8.82 8.86 8.91 ascon128v12 8.85 8.88 8.89 ascon80pqv12 9.03 9.06 9.12 T:xoodyakround3 10.90 10.92 10.94 ascon128abi32v12 16.42 16.47 16.94 T:schwaemm256128v2 16.47 16.49 16.51 ascon128bi32v12 18.40 18.45 18.46 T:isapa128v20 21.59 21.77 22.38 T:schwaemm256256v2 22.35 22.40 22.49 T:schwaemm192192v2 21.83 22.99 23.26 T:schwaemm128128v2 22.83 23.01 23.05 romulusm 23.16 23.18 23.25 romulusn 25.36 25.53 25.97 T:isapa128av20 27.13 27.30 27.35 T:grain128aeadv2 32.31 32.36 32.48 T:tinyjambu256v2 33.06 33.09 33.11 T:tinyjambu128v2 33.53 33.66 34.92 T:tinyjambu192v2 38.71 38.73 38.76 T:giftcofb128v1 39.11 39.29 39.35 romulust 39.70 40.09 40.44 T:isapk128av20 49.92 50.30 50.62 T:isapk128v20 73.57 74.37 74.62 T:elephant200v2 92.82 92.93 93.61 T:isapxv20 3145.92 3162.37 3173.27 T:elephant176v2 3842.31 3896.71 3907.48 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.20? 0.23? 0.27? T:aes128gcmv1 0.23? 0.26? 0.28? T:aes256gcmv1 0.45 0.45 0.46 aes256gcmv1 1.40 1.43 1.46 aes128gcmv1 5.94 5.96 5.96 ascon128av12 8.83 8.85 8.90 ascon128v12 8.84 8.86 8.89 ascon80pqv12 9.02 9.07 9.12 T:xoodyakround3 10.90 10.93 10.95 ascon128abi32v12 16.47 16.49 16.52 ascon128bi32v12 16.45 16.52 16.92 T:schwaemm256128v2 18.38 18.43 18.48 T:isapa128v20 21.62 21.79 22.37 T:schwaemm256256v2 22.36 22.44 22.47 T:schwaemm192192v2 21.78 22.90 23.26 T:schwaemm128128v2 22.99 23.01 23.02 romulusm 23.17 23.22 23.26 romulusn 25.33 25.52 26.01 T:isapa128av20 27.19 27.27 27.38 T:grain128aeadv2 33.05 33.08 33.11 T:tinyjambu128v2 32.39 33.33 33.41 T:tinyjambu256v2 33.59 34.91 34.96 T:tinyjambu192v2 38.75 38.77 38.81 T:giftcofb128v1 39.06 39.09 39.19 romulust 39.57 40.10 40.46 T:isapk128av20 49.97 50.35 50.67 T:isapk128v20 73.52 74.36 74.60 T:elephant200v2 92.79 93.00 93.70 T:isapxv20 3145.73 3162.55 3173.16 T:elephant176v2 3842.34 3904.22 3916.49 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 0.87 0.88 0.90 T:aes128gcmv1 0.91 0.93 0.94 T:aes256gcmv1 1.04 1.04 1.05 aes256gcmv1 2.95 2.97 3.01 aes128gcmv1 6.37 6.38 6.39 ascon128av12 9.03 9.04 9.06 ascon128v12 9.05 9.06 9.06 ascon80pqv12 11.30 11.31 11.32 ascon128abi32v12 13.43 13.44 13.48 T:xoodyakround3 16.87 16.88 16.89 ascon128bi32v12 17.06 17.08 17.49 T:schwaemm256128v2 22.29 22.49 23.00 T:schwaemm256256v2 22.87 23.04 23.07 T:schwaemm192192v2 23.72 23.74 24.03 T:schwaemm128128v2 27.53 27.58 27.60 T:grain128aeadv2 30.19 30.23 30.28 romulusn 35.12 35.15 35.85 T:isapa128av20 39.14 39.16 39.20 T:giftcofb128v1 40.44 40.46 40.50 T:isapa128v20 41.99 42.01 42.05 romulusm 42.58 42.60 42.63 T:tinyjambu128v2 46.76 47.04 47.22 T:tinyjambu192v2 47.93 48.27 48.60 T:tinyjambu256v2 58.23 58.30 58.42 T:isapk128av20 78.05 78.08 78.20 romulust 112.26 113.26 113.64 T:elephant200v2 115.17 115.30 115.36 T:isapk128v20 205.49 206.48 221.91 T:isapxv20 4798.62 4842.18 4871.99 T:elephant176v2 5918.31 5948.87 5959.78 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 0.85 0.87 0.90 T:aes128gcmv1 0.90 0.91 0.92 T:aes256gcmv1 1.04 1.05 1.06 aes256gcmv1 2.98 3.02 3.06 aes128gcmv1 6.16 6.17 6.19 ascon128av12 9.01 9.03 9.06 ascon128v12 9.04 9.05 9.06 ascon80pqv12 11.28 11.29 11.30 ascon128abi32v12 13.13 13.40 13.48 T:xoodyakround3 16.90 16.92 16.94 ascon128bi32v12 17.05 17.07 17.49 T:schwaemm256128v2 22.24 22.42 22.97 T:schwaemm256256v2 22.84 23.02 23.05 T:schwaemm192192v2 23.34 23.75 24.05 T:schwaemm128128v2 27.43 27.46 27.51 T:grain128aeadv2 30.19 30.24 30.32 romulusn 35.22 35.25 35.93 T:isapa128av20 39.18 39.22 39.26 T:giftcofb128v1 40.44 40.45 40.51 T:isapa128v20 41.92 42.06 42.11 romulusm 42.61 42.63 42.65 T:tinyjambu128v2 46.77 46.81 47.22 T:tinyjambu192v2 47.67 47.80 48.49 T:tinyjambu256v2 58.26 58.29 58.43 T:isapk128av20 78.06 78.11 78.21 romulust 111.99 113.15 113.48 T:elephant200v2 115.22 115.29 115.36 T:isapk128v20 205.48 206.38 206.92 T:isapxv20 4798.47 4841.99 4871.90 T:elephant176v2 5908.52 5918.34 5959.79 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 0.85 0.85 0.87 T:aes128gcmv1 0.89 0.90 0.92 T:aes256gcmv1 1.03 1.04 1.04 aes256gcmv1 1.59 1.61 1.63 aes128gcmv1 6.15 6.16 6.17 ascon128av12 9.01 9.02 9.04 ascon128v12 9.04 9.05 9.06 ascon80pqv12 11.26 11.27 11.30 ascon128abi32v12 13.16 13.18 13.33 T:xoodyakround3 16.90 16.91 16.92 ascon128bi32v12 17.06 17.09 17.48 T:schwaemm256128v2 22.25 22.42 22.96 T:schwaemm256256v2 22.85 23.03 23.05 T:schwaemm192192v2 23.31 23.74 24.04 T:schwaemm128128v2 24.90 24.91 24.93 T:isapa128v20 27.18 27.23 27.81 T:isapa128av20 27.42 27.45 27.50 T:grain128aeadv2 30.22 30.27 30.28 romulusn 39.18 39.21 39.25 T:giftcofb128v1 40.28 40.30 40.31 romulust 41.96 42.06 42.11 romulusm 42.59 42.61 42.64 T:tinyjambu128v2 45.32 45.42 45.46 T:isapk128av20 45.60 46.78 46.85 T:tinyjambu192v2 47.82 48.33 48.81 T:tinyjambu256v2 76.77 76.83 76.86 T:isapk128v20 111.99 113.10 113.46 T:elephant200v2 133.83 134.37 134.58 T:isapxv20 4798.35 4841.78 4871.92 T:elephant176v2 5907.75 5918.48 5952.28 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 5.16 5.23 5.37 aes256gcmv1 5.64 5.80 5.95 aes128gcmv1 9.94 10.18 10.54 ascon128av12 11.14 11.34 12.10 T:aes128gcmv1 11.51 11.86 12.53 T:aes256gcmv1 11.99 12.21 12.36 ascon128v12 12.21 12.43 12.74 ascon80pqv12 17.00 17.27 17.64 ascon128abi32v12 19.23 19.41 19.66 T:xoodyakround3 22.67 22.86 23.26 ascon128bi32v12 27.94 28.21 28.79 T:schwaemm256128v2 29.98 30.25 30.70 T:schwaemm128128v2 34.35 34.39 34.56 T:grain128aeadv2 35.68 36.32 36.82 T:schwaemm256256v2 37.20 37.40 37.90 T:schwaemm192192v2 37.88 38.10 38.21 romulusn 47.09 47.19 47.38 T:giftcofb128v1 48.92 49.27 49.56 romulusm 49.84 50.04 50.29 T:tinyjambu128v2 54.70 54.98 55.66 T:tinyjambu192v2 56.12 56.73 57.09 T:tinyjambu256v2 104.48 104.64 104.92 romulust 108.52 108.74 109.23 T:isapa128av20 160.02 160.35 161.02 T:elephant200v2 231.66 232.61 234.92 T:isapk128av20 332.36 332.66 333.05 T:isapa128v20 1254.59 1256.84 1258.91 T:isapk128v20 2015.50? 2016.12? 2387.44? T:isapxv20 5987.48 6002.33 6003.12 T:elephant176v2 7947.88 7988.26 8015.92 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 5.01 5.05 5.42 aes256gcmv1 6.45 6.68 6.83 aes128gcmv1 9.49 9.73 10.14 ascon128av12 11.06 11.29 12.02 T:aes128gcmv1 11.30 11.41 12.09 T:aes256gcmv1 12.02 12.18 12.38 ascon80pqv12 12.09 12.32 12.75 ascon128v12 17.05 17.30 17.80 ascon128abi32v12 19.17 19.29 19.82 T:xoodyakround3 22.91 23.04 23.74 ascon128bi32v12 27.80 28.03 28.86 T:schwaemm256128v2 29.64 29.91 30.30 T:schwaemm128128v2 34.64 34.77 34.96 T:grain128aeadv2 35.88 36.32 36.82 T:schwaemm256256v2 37.01 37.27 37.55 T:schwaemm192192v2 38.13 38.24 38.43 romulusn 47.49 47.58 47.65 T:giftcofb128v1 49.98 50.12 50.34 T:tinyjambu128v2 50.02 50.25 50.43 romulusm 55.24 55.69 56.38 T:tinyjambu192v2 56.04 56.25 57.12 T:tinyjambu256v2 104.52 104.73 105.08 romulust 110.92 111.39 111.88 T:isapa128av20 158.88 160.22 160.73 T:elephant200v2 231.99 233.28 234.52 T:isapk128av20 333.20 333.45 333.62 T:isapa128v20 1253.21 1256.97 1258.42 T:isapk128v20 2016.42 2017.76 2021.74 T:isapxv20 5984.54 6001.25 6003.02 T:elephant176v2 7948.84 7981.43 7987.75 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 4.79 4.89 5.29 aes128gcmv1 4.92 5.09 5.16 aes256gcmv1 9.50 9.55 9.85 ascon128av12 11.24 11.38 11.62 T:aes256gcmv1 11.29 11.41 11.77 T:aes128gcmv1 11.94 12.03 12.23 ascon128v12 12.07 12.22 12.37 ascon80pqv12 17.03 17.09 17.16 ascon128abi32v12 19.52 19.86 19.88 T:xoodyakround3 22.88 22.94 23.17 ascon128bi32v12 27.80 27.92 28.62 T:schwaemm256128v2 29.57 29.84 30.23 T:schwaemm128128v2 34.41 34.57 34.70 T:grain128aeadv2 35.62 35.92 36.71 T:schwaemm256256v2 36.91 37.10 37.27 T:schwaemm192192v2 38.12 38.16 38.19 romulusn 47.45 47.55 47.62 T:giftcofb128v1 49.99 50.06 50.12 T:tinyjambu128v2 50.04 50.15 50.46 romulusm 54.91 55.15 55.41 T:tinyjambu192v2 56.02 56.23 56.61 T:tinyjambu256v2 65.78 66.16 66.35 romulust 69.48 69.68 70.18 T:isapa128av20 156.01 157.39 157.91 T:isapk128av20 158.77 160.00 160.70 T:elephant200v2 173.62 174.06 174.16 T:isapa128v20 677.56 680.42 681.11 T:isapk128v20 1052.88 1054.23 1057.92 T:isapxv20 5985.58 6002.08 6003.23 T:elephant176v2 7948.34 7981.42 7985.78 T:elephant160v2