VAMPIRE

eBACS: ECRYPT Benchmarking of Cryptographic Systems


ECRYPT II
General information:IntroductioneBASHeBASCeBAEADeBATSSUPERCOPXBXComputersArch
How to submit new software:Tipshashstreamaeaddhkemencryptsign
List of primitives measured:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
Measurements:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
List of subroutines:verifydecodeencodesortcorehashblocksxofscalarmult

Measurements of public-key Diffie–Hellman secret-sharing systems on one machine: amd64; Zen 4 (a60f12); 2023 AMD Ryzen 7 7700; 8 x 3800MHz; hertz, supercop-20261004

[Page version: 20261011 10:37:58]

eBATS (ECRYPT Benchmarking of Asymmetric Systems) is a project to measure the performance of public-key systems. This page presents benchmark results collected in eBATS for public-key Diffie–Hellman secret-sharing systems:

Each table row lists the first quartile of many speed measurements (or StQ1 starting with supercop-20260214), the median of many speed measurements (or StQ2 starting with supercop-20260214), the third quartile of many speed measurements (or StQ3 starting with supercop-20260214), and the name of the primitive. Measurements with large interquartile range (or stabilized interquartile range) are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each Diffie–Hellman system and each implementation. Designers and implementors interested in submitting new Diffie–Hellman systems and new implementations of existing systems should read the call for submissions.


Test results

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%50%75%system
224102242722492curve25519
255862688228156
T:
jacfp127i
264262820529342
T:
kumjacfp127g
261272831230488
T:
hecfp127i
274202857130028
T:
prjfp127i
308533100931587
T:
gls254
314583154331599
T:
gls254prot
304833160732913
T:
jacfp128bk
309313223035278
T:
ecfp256e
342563567439330
T:
curve2251
358233728839014
T:
prjfp128bk
363413738338527
T:
hecfp128i
363933757638815
T:
hecfp128fkt
366163818840094
T:
hecfp128bk
356543825843518
T:
ecfp256s
375164002346080
T:
ecfp256q
406674072441393nistp256
424984252642564
T:
kummer
427834282242858
T:
k277taa
482644840749414
T:
k298
607966084861364
T:
k277mon
787887885478941
T:
kumfp127g
104041104109104192
T:
kumfp128g
144132144992145911
T:
ecfp256i
160231160587160960
T:
ed448goldilocks
162577163503164642
T:
ecfp256h
208140210552212376
T:
sclaus1024
777834780246782137
T:
ed521gs
938206940365942357
T:
nist521gs
101384510168511024753
T:
claus
109396311028191109942
T:
sclaus2048
Cycles to compute a shared secret
25%50%75%system
294762952729592
T:
gls254
314363150831547
T:
gls254prot
424644249142529
T:
kummer
426894280342831
T:
k277taa
481024819848270
T:
k298
534435354553554curve25519
608476133661375
T:
k277mon
788567890979004
T:
jacfp128bk
813968142281515
T:
kumfp127g
823088264282930
T:
kumjacfp127g
935739368293809
T:
prjfp128bk
976179776398002
T:
hecfp128fkt
988039890499074
T:
hecfp128bk
108912108950109024
T:
kumfp128g
121003121112121344
T:
jacfp127i
129415129530129581
T:
ecfp256e
134635136505136723
T:
curve2251
137281137331137358
T:
ecfp256i
140462140513140582
T:
ecfp256q
150020150147150244
T:
prjfp127i
152909153015153168
T:
hecfp127i
153902153912153932nistp256
155249155295155381
T:
ecfp256h
194305194445194609
T:
ecfp256s
210572210711210808
T:
hecfp128i
214389215951217246
T:
sclaus1024
542420544148545787
T:
ed448goldilocks
775844778378779546
T:
ed521gs
936648938962941590
T:
nist521gs
101320310154781020996
T:
claus
111034611154061121030
T:
sclaus2048