VAMPIRE

eBACS: ECRYPT Benchmarking of Cryptographic Systems


ECRYPT II
General information:IntroductioneBASHeBASCeBAEADeBATSSUPERCOPXBXComputersArch
How to submit new software:Tipshashstreamaeaddhkemencryptsign
List of primitives measured:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
Measurements:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
List of subroutines:verifydecodeencodesortcorehashblocksxofscalarmult

Measurements of public-key Diffie–Hellman secret-sharing systems on one machine: amd64; Zen 4 (a60f12); 2023 AMD Ryzen 7 7700; 8 x 3800MHz; hertz, supercop-20261018

[Page version: 20261103 15:52:03]

eBATS (ECRYPT Benchmarking of Asymmetric Systems) is a project to measure the performance of public-key systems. This page presents benchmark results collected in eBATS for public-key Diffie–Hellman secret-sharing systems:

Each table row lists the first quartile of many speed measurements (or StQ1 starting with supercop-20260214), the median of many speed measurements (or StQ2 starting with supercop-20260214), the third quartile of many speed measurements (or StQ3 starting with supercop-20260214), and the name of the primitive. Measurements with large interquartile range (or stabilized interquartile range) are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each Diffie–Hellman system and each implementation. Designers and implementors interested in submitting new Diffie–Hellman systems and new implementations of existing systems should read the call for submissions.


Test results

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%50%75%system
224022240922423curve25519
260812772128968
T:
jacfp127i
264412795729315
T:
kumjacfp127g
269342842930020
T:
hecfp127i
278032911730852
T:
prjfp127i
308433095631434
T:
gls254
314083147831560
T:
gls254prot
305893167932905
T:
jacfp128bk
306763227935643
T:
ecfp256e
342083562139547
T:
curve2251
354313670637992
T:
prjfp128bk
365763798039774
T:
hecfp128bk
359183801943222
T:
ecfp256s
370993867140294
T:
hecfp128i
371223875640312
T:
hecfp128fkt
374173988445417
T:
ecfp256q
407524102541594nistp256
424844252242568
T:
kummer
427294279042847
T:
k277taa
482584845349688
T:
k298
608026113061375
T:
k277mon
792227933879441
T:
kumfp127g
104125104181104263
T:
kumfp128g
143885144709145809
T:
ecfp256i
160306160750161287
T:
ed448goldilocks
162714163597164656
T:
ecfp256h
207668210032211845
T:
sclaus1024
777950781577792371
T:
ed521gs
938871941078943562
T:
nist521gs
101808310229131025521
T:
claus
109309411005721107773
T:
sclaus2048
Cycles to compute a shared secret
25%50%75%system
296552969429739
T:
gls254
312653131731470
T:
gls254prot
424614248542530
T:
kummer
426614269842822
T:
k277taa
481364820448272
T:
k298
535795358053585curve25519
608686130861353
T:
k277mon
790627919379371
T:
jacfp128bk
815118153481570
T:
kumfp127g
823898263382843
T:
kumjacfp127g
938299396594151
T:
prjfp128bk
970579727997490
T:
hecfp128fkt
986689884098994
T:
hecfp128bk
108971109021109055
T:
kumfp128g
120949121024121118
T:
jacfp127i
128890128965129059
T:
ecfp256e
135742136282136669
T:
curve2251
137493137573137658
T:
ecfp256i
140357140418140497
T:
ecfp256q
150188150290150395
T:
prjfp127i
153179153264153418
T:
hecfp127i
153721153968154034nistp256
155426155484155605
T:
ecfp256h
196618196730196852
T:
ecfp256s
210702210779210856
T:
hecfp128i
215102215832216938
T:
sclaus1024
535019540361545326
T:
ed448goldilocks
778715781062790743
T:
ed521gs
938009940274942424
T:
nist521gs
101161510140011020076
T:
claus
110852711173361122023
T:
sclaus2048