VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates, indexed by machine

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation.

Each computer name is linked to additional information about the implementations and compilers selected for benchmarking.

There is a separate page with more information about each cipher and each implementation.

amd64; Golden Cove (906a4-40); 2022 Intel Core i3-1215U, P cores; 2 x 1600MHz; alder2,1f626960,5600000, supercop-20230530

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 0.52 0.53 0.54 T:aes128gcmv1 0.60 0.62 0.63 T:aes256gcmv1 1.53 1.54 1.55 aes256gcmv1 6.54 6.57 6.60 ascon128av12 9.83 9.86 9.91 ascon128v12 9.97 10.01 10.07 ascon80pqv12 13.04 13.07 13.14 ascon128abi32v12 13.39 13.44 13.49 T:schwaemm256128v2 15.27 15.35 15.42 T:xoodyakround3 17.73 17.78 17.84 T:schwaemm192192v2 18.93 19.00 19.16 T:schwaemm256256v2 19.84 19.88 19.91 T:schwaemm128128v2 19.90 19.95 20.03 ascon128bi32v12 24.29 24.45 25.34 T:grain128aeadv2 38.46 38.50 38.55 romulusn 39.01 39.18 39.59 T:isapa128av20 39.06 39.64 39.80 T:isapa128v20 39.75 39.83 39.88 T:giftcofb128v1 48.99 49.60 50.10 T:isapk128av20 55.00 55.06 55.15 T:tinyjambu128v2 61.76 61.80 61.86 romulusm 66.48 66.55 66.68 T:tinyjambu192v2 66.42 67.16 68.65 T:isapk128v20 71.11 71.26 71.29 T:tinyjambu256v2 110.00 110.42 110.68 T:elephant200v2 119.31 119.42 119.49 romulust 119.10 119.78 121.36 T:isapxv20 5794.71 5810.85 5830.95 T:elephant176v2 5888.38 5890.58 5892.13 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 0.46? 0.52? 0.54? T:aes128gcmv1 0.59 0.60 0.65 T:aes256gcmv1 1.41 1.42 1.43 aes256gcmv1 6.58 6.64 6.73 ascon128av12 9.67 9.76 10.09 ascon80pqv12 9.74 9.80 9.85 ascon128v12 13.01 13.09 13.13 ascon128abi32v12 13.35 13.41 13.45 T:schwaemm256128v2 15.15 15.26 15.33 T:xoodyakround3 17.62 17.74 17.79 T:schwaemm192192v2 19.76 19.83 19.85 T:schwaemm128128v2 19.94 20.03 20.12 ascon128bi32v12 18.97 20.15 20.42 T:schwaemm256256v2 23.62 23.71 25.35 T:grain128aeadv2 38.55 38.56 38.64 romulusn 39.32 39.44 39.79 T:isapa128v20 39.52 39.64 39.80 T:isapa128av20 39.81 39.83 39.87 T:giftcofb128v1 48.99 49.45 50.13 T:isapk128av20 54.82 54.90 55.00 T:tinyjambu128v2 61.78 61.87 61.97 romulusm 66.36 66.48 66.64 T:tinyjambu192v2 66.20 67.37 67.92 T:isapk128v20 70.63 71.15 71.49 T:tinyjambu256v2 110.04 110.33 111.30 T:elephant200v2 119.30 119.41 119.55 romulust 120.89 121.44 121.74 T:isapxv20 5774.64 5794.81 5820.40 T:elephant176v2 5886.55 5891.73 5894.60 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 0.51 0.53 0.56 T:aes128gcmv1 0.60 0.61 0.62 T:aes256gcmv1 1.41 1.42 1.43 aes256gcmv1 6.56 6.63 6.69 ascon128av12 9.73 9.78 9.85 ascon80pqv12 9.77 9.78 9.83 ascon128v12 13.05 13.10 13.14 ascon128abi32v12 13.38 13.42 13.45 T:schwaemm256128v2 15.16 15.20 15.27 T:xoodyakround3 17.67 17.73 17.77 T:schwaemm192192v2 18.89 18.98 19.14 T:schwaemm256256v2 19.41 19.44 19.52 T:isapa128v20 19.77 19.81 19.88 T:schwaemm128128v2 20.05 20.07 20.20 ascon128bi32v12 23.63 23.71 25.31 T:grain128aeadv2 26.27 26.37 26.48 T:isapa128av20 33.02 33.09 33.26 T:isapk128av20 38.55 38.62 38.65 romulusn 39.78 39.84 39.88 T:giftcofb128v1 41.28 41.32 41.46 romulust 42.20 43.14 43.70 T:isapk128v20 54.85 54.92 55.00 T:tinyjambu128v2 61.75 61.83 61.93 romulusm 66.42 66.50 66.69 T:tinyjambu192v2 70.60 70.71 71.42 T:tinyjambu256v2 72.15 72.33 72.63 T:isapxv20 110.44 110.93 111.01 T:elephant200v2 5766.08 5792.66 5806.19 T:elephant176v2 5890.79 5891.82 5892.58 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.37 0.38 0.38 T:aes128gcmv1 0.42 0.43 0.43 T:aes256gcmv1 0.91 0.92 0.93 aes256gcmv1 6.50 6.55 6.58 ascon128av12 9.64 9.69 9.85 ascon80pqv12 9.77 9.80 9.83 ascon128v12 11.47 11.53 11.58 T:xoodyakround3 13.24 13.30 13.35 ascon128abi32v12 13.33 13.40 13.42 T:schwaemm256128v2 17.65 17.75 17.83 T:schwaemm192192v2 18.86 19.00 19.10 T:schwaemm256256v2 19.81 19.85 19.87 T:schwaemm128128v2 20.12 20.17 20.24 ascon128bi32v12 24.19 24.26 25.28 T:grain128aeadv2 29.43 29.59 29.70 T:isapa128v20 30.86 30.88 30.91 romulusn 32.42 32.46 32.54 T:isapa128av20 39.77 39.80 39.83 T:giftcofb128v1 41.52 42.08 42.28 T:isapk128av20 42.52 42.55 42.59 romulusm 44.97 45.02 45.09 T:tinyjambu128v2 52.13 52.19 52.24 T:tinyjambu192v2 53.79 53.90 54.00 T:tinyjambu256v2 53.39 54.74 55.61 T:isapk128v20 80.37 80.43 80.49 romulust 82.82 82.97 83.07 T:elephant200v2 96.78 97.16 97.92 T:isapxv20 4318.24 4334.16 4342.90 T:elephant176v2 4414.27 4416.12 4417.60 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.35 0.37 0.38 T:aes128gcmv1 0.40 0.41 0.42 T:aes256gcmv1 0.84 0.86 0.87 aes256gcmv1 6.48 6.53 6.57 ascon128av12 9.64 9.74 9.80 ascon80pqv12 9.74 9.77 9.81 ascon128v12 11.40 11.44 11.50 T:xoodyakround3 13.28 13.32 13.36 ascon128abi32v12 13.30 13.36 13.39 T:schwaemm256128v2 17.69 17.75 17.77 T:schwaemm192192v2 18.89 19.02 19.81 T:schwaemm256256v2 19.79 19.81 19.84 T:schwaemm128128v2 20.12 20.17 20.20 ascon128bi32v12 23.84 24.01 25.24 T:grain128aeadv2 29.25 29.60 29.69 T:isapa128v20 30.88 30.91 30.98 romulusn 32.67 32.86 32.93 T:isapa128av20 39.77 39.81 39.84 T:giftcofb128v1 41.43 41.67 42.16 T:isapk128av20 42.53 42.58 42.67 romulusm 44.89 44.92 45.03 T:tinyjambu128v2 52.11 52.16 52.28 T:tinyjambu192v2 53.65 53.71 53.95 T:tinyjambu256v2 54.20 55.03 55.90 T:isapk128v20 80.33 80.40 80.49 romulust 82.85 83.11 83.17 T:elephant200v2 96.33 96.53 96.98 T:isapxv20 4322.47 4339.69 4349.09 T:elephant176v2 4414.16 4416.37 4418.15 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.34? 0.37? 0.38? T:aes128gcmv1 0.41? 0.42? 0.46? T:aes256gcmv1 0.85 0.86 0.87 aes256gcmv1 6.52 6.55 6.58 ascon128av12 9.56 9.62 9.71 ascon80pqv12 9.75 9.77 9.80 ascon128v12 11.41 11.43 11.47 T:xoodyakround3 13.31 13.35 13.38 ascon128abi32v12 13.32 13.36 13.41 T:schwaemm256128v2 17.66 17.68 17.72 T:schwaemm192192v2 18.87 18.92 19.08 T:schwaemm256256v2 19.43 19.47 19.52 T:isapa128v20 19.81 19.83 19.85 T:schwaemm128128v2 20.04 20.09 20.16 ascon128bi32v12 23.96 24.03 25.20 T:grain128aeadv2 26.32 26.36 26.40 T:isapa128av20 30.90 30.93 30.97 romulusn 33.20 33.63 34.12 T:isapk128av20 39.77 39.83 39.85 T:giftcofb128v1 41.34 41.39 41.44 romulust 41.62 42.19 42.67 T:isapk128v20 42.54 42.61 42.69 romulusm 44.93 44.99 45.12 T:tinyjambu128v2 52.09 52.15 52.21 T:tinyjambu192v2 53.85 53.94 54.01 T:tinyjambu256v2 72.58 72.73 73.07 T:isapxv20 82.84 82.93 83.49 T:elephant200v2 4332.93 4344.15 4351.06 T:elephant176v2 4416.13 4417.36 4418.26 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.21? 0.23? 0.25? T:aes128gcmv1 0.21? 0.24? 0.25? T:aes256gcmv1 0.29? 0.31? 0.33? aes256gcmv1 6.43 6.52 6.59 ascon128av12 7.59 7.66 7.71 T:xoodyakround3 9.68 9.74 9.76 ascon128v12 9.60 10.19 10.30 ascon80pqv12 13.16 13.24 13.30 T:schwaemm256128v2 13.48 13.64 13.82 ascon128abi32v12 17.63 17.70 17.81 T:schwaemm192192v2 18.73 18.82 20.14 T:schwaemm256256v2 19.43 19.49 19.56 T:isapa128v20 19.79 19.81 19.85 T:schwaemm128128v2 20.32 20.47 20.62 ascon128bi32v12 23.22 23.26 23.28 romulusn 23.26 23.32 23.38 romulusm 24.09 24.19 25.16 T:grain128aeadv2 26.23 26.29 26.43 T:isapa128av20 33.09 33.87 34.22 T:isapk128av20 34.83 34.87 34.93 T:tinyjambu128v2 36.30 36.36 36.44 T:tinyjambu256v2 37.65 37.76 37.85 T:tinyjambu192v2 39.80 39.83 39.89 T:giftcofb128v1 41.29 41.35 41.43 romulust 41.10 41.76 42.87 T:isapk128v20 55.66 55.87 56.28 T:elephant200v2 72.40 72.60 73.75 T:isapxv20 2847.94 2857.37 2872.09 T:elephant176v2 2942.08 2943.40 2944.16 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.20? 0.23? 0.24? T:aes128gcmv1 0.21? 0.23? 0.25? T:aes256gcmv1 0.28? 0.32? 0.33? aes256gcmv1 6.44 6.48 6.56 ascon128av12 7.54 7.61 7.68 T:xoodyakround3 9.58 9.63 9.87 ascon80pqv12 9.70 9.74 9.77 ascon128v12 13.21 13.33 13.42 T:schwaemm256128v2 13.50 13.57 13.70 ascon128abi32v12 17.66 17.71 17.74 T:schwaemm192192v2 18.70 18.86 20.55 T:schwaemm256256v2 19.40 19.47 19.53 T:isapa128v20 19.80 19.83 19.87 T:schwaemm128128v2 20.00 20.07 20.18 ascon128bi32v12 23.22 23.26 23.31 romulusn 23.26 23.30 23.32 romulusm 24.29 24.38 25.12 T:grain128aeadv2 26.29 26.35 26.46 T:isapa128av20 32.30 33.17 33.92 T:isapk128av20 34.81 34.86 34.92 T:tinyjambu128v2 36.29 36.37 36.44 T:tinyjambu256v2 37.55 37.64 37.69 T:tinyjambu192v2 39.76 39.80 39.86 T:giftcofb128v1 41.27 41.36 41.44 romulust 40.65 41.88 42.38 T:isapk128v20 56.11 56.21 56.31 T:elephant200v2 72.80 72.97 73.19 T:isapxv20 2849.29 2861.51 2881.16 T:elephant176v2 2939.92 2942.85 2943.95 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.22? 0.23? 0.26? T:aes256gcmv1 0.22? 0.24? 0.29? T:aes128gcmv1 0.29 0.30 0.31 aes256gcmv1 6.41 6.47 6.53 ascon128av12 7.56 7.61 7.68 T:xoodyakround3 9.59 9.64 9.86 ascon80pqv12 9.69 9.72 9.75 ascon128v12 13.26 13.31 13.38 T:schwaemm256128v2 13.52 13.59 13.68 ascon128abi32v12 17.61 17.66 17.71 T:schwaemm192192v2 18.75 18.94 19.31 T:schwaemm256256v2 19.41 19.45 19.51 T:isapa128v20 19.74 19.82 19.85 T:schwaemm128128v2 20.03 20.10 20.19 ascon128bi32v12 23.23 23.27 23.34 romulusm 23.24 23.29 23.32 romulusn 24.04 24.11 25.02 T:grain128aeadv2 26.26 26.39 26.48 T:isapa128av20 32.44 33.11 33.47 T:isapk128av20 34.83 34.87 34.95 T:tinyjambu128v2 36.30 36.35 36.43 T:tinyjambu256v2 37.51 37.60 37.71 T:tinyjambu192v2 39.74 39.77 39.86 T:giftcofb128v1 41.30 41.36 41.44 romulust 40.28 41.55 42.45 T:isapk128v20 55.78 55.93 56.13 T:elephant200v2 72.29 72.59 74.03 T:isapxv20 2850.02 2866.47 2876.51 T:elephant176v2 2939.75 2941.36 2942.74 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 0.72 0.73 0.74 T:aes128gcmv1 0.78 0.78 0.79 T:aes256gcmv1 1.06 1.06 1.06 aes256gcmv1 6.69 6.71 6.73 ascon128av12 9.72 9.79 9.95 ascon80pqv12 9.91 9.93 9.96 ascon128v12 11.59 11.61 11.67 T:xoodyakround3 13.51 13.66 13.67 ascon128abi32v12 13.74 13.76 13.79 T:schwaemm256128v2 18.09 18.15 18.19 T:schwaemm192192v2 19.54 19.57 21.00 T:schwaemm256256v2 20.08 20.10 20.14 T:schwaemm128128v2 20.43 20.49 20.54 ascon128bi32v12 24.55 24.65 25.46 T:grain128aeadv2 31.16 31.17 31.19 romulusn 36.10 36.20 36.55 T:isapa128av20 40.13 40.15 40.18 T:giftcofb128v1 42.69 42.80 42.97 T:isapa128v20 42.81 42.84 42.90 romulusm 45.51 45.52 45.57 T:tinyjambu128v2 46.66 46.86 47.23 T:isapk128av20 52.67 52.74 52.77 T:tinyjambu192v2 54.30 54.35 54.39 T:tinyjambu256v2 81.59 81.62 81.66 romulust 84.52 84.65 84.94 T:elephant200v2 93.45 94.46 94.90 T:isapk128v20 159.93 160.19 160.78 T:isapxv20 4350.98 4371.98 4387.04 T:elephant176v2 4464.55 4466.17 4466.89 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 0.72 0.73 0.75 T:aes128gcmv1 0.78 0.79 0.79 T:aes256gcmv1 1.00 1.01 1.01 aes256gcmv1 6.66 6.69 6.74 ascon128av12 9.79 9.83 9.92 ascon80pqv12 9.88 9.89 9.91 ascon128v12 11.52 11.53 11.60 T:xoodyakround3 13.60 13.63 13.66 ascon128abi32v12 13.73 13.76 13.80 T:schwaemm256128v2 18.07 18.12 18.16 T:schwaemm192192v2 19.54 19.57 19.59 T:schwaemm256256v2 20.04 20.07 20.10 T:schwaemm128128v2 20.35 20.37 20.45 ascon128bi32v12 24.32 24.42 25.56 T:grain128aeadv2 31.22 31.24 31.25 romulusn 36.42 36.67 36.76 T:isapa128av20 40.13 40.15 40.19 T:giftcofb128v1 42.70 42.86 42.94 T:isapa128v20 42.90 42.99 43.05 romulusm 45.37 45.41 45.43 T:tinyjambu128v2 46.77 46.96 47.11 T:isapk128av20 52.58 52.66 52.68 T:tinyjambu192v2 54.04 54.09 54.39 T:tinyjambu256v2 81.57 81.60 81.66 romulust 84.39 84.57 85.10 T:elephant200v2 93.77 94.03 94.40 T:isapk128v20 159.84 160.44 161.82 T:isapxv20 4360.96 4371.25 4387.98 T:elephant176v2 4461.37 4463.78 4467.77 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 0.72 0.72 0.73 T:aes128gcmv1 0.78 0.79 0.79 T:aes256gcmv1 1.00 1.01 1.01 aes256gcmv1 6.65 6.68 6.72 ascon128av12 9.80 9.87 9.99 ascon80pqv12 9.87 9.90 9.93 ascon128v12 11.54 11.56 11.58 T:xoodyakround3 13.62 13.65 13.69 ascon128abi32v12 13.75 13.82 13.84 T:schwaemm256128v2 18.07 18.12 18.16 T:schwaemm192192v2 19.52 19.56 20.72 T:schwaemm256256v2 20.04 20.07 20.11 T:schwaemm128128v2 20.34 20.38 20.41 ascon128bi32v12 24.34 24.38 25.53 T:grain128aeadv2 26.23 26.24 26.27 T:isapa128v20 28.28 28.33 28.39 T:isapa128av20 31.22 31.24 31.26 romulusn 36.45 36.68 37.20 T:isapk128av20 40.13 40.16 40.18 T:giftcofb128v1 42.47 42.51 42.58 romulust 42.88 42.94 43.03 romulusm 45.37 45.40 45.43 T:tinyjambu128v2 52.60 52.63 52.69 T:tinyjambu192v2 54.37 54.40 54.44 T:tinyjambu256v2 61.97 62.40 62.61 T:isapk128v20 84.48 84.86 85.09 T:elephant200v2 104.83 104.96 105.21 T:isapxv20 4346.03 4358.16 4366.79 T:elephant176v2 4464.28 4465.49 4468.08 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 5.62 5.68 5.75 aes256gcmv1 8.86 9.04 9.29 T:aes128gcmv1 9.23 9.44 9.68 T:aes256gcmv1 10.40 10.46 10.74 ascon128av12 12.85 13.02 13.08 ascon128v12 12.98 13.16 13.41 ascon80pqv12 16.80 17.09 17.47 T:xoodyakround3 19.92 20.20 20.62 ascon128abi32v12 22.49 22.72 23.35 T:schwaemm256128v2 25.52 25.72 25.98 T:schwaemm128128v2 27.22 27.44 27.62 ascon128bi32v12 28.97 29.28 29.52 T:schwaemm192192v2 30.98 31.20 33.45 T:schwaemm256256v2 32.61 32.71 33.31 T:grain128aeadv2 37.45 37.62 37.80 romulusn 47.30 47.45 47.56 T:giftcofb128v1 50.02 50.37 50.93 romulusm 55.88 56.14 56.44 T:tinyjambu128v2 64.24 64.80 65.29 T:tinyjambu192v2 65.69 66.23 66.73 T:tinyjambu256v2 108.25 108.58 108.88 romulust 118.57 118.83 119.30 T:isapa128av20 119.09 119.25 119.52 T:elephant200v2 150.54 151.16 151.53 T:isapk128av20 349.20 349.64 349.96 T:isapa128v20 988.41 992.39 998.54 T:isapk128v20 1599.95 1602.34 1604.79 T:isapxv20 5407.14 5463.36 5474.98 T:elephant176v2 5978.43 5982.95 5986.67 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 5.74 5.86 6.00 aes256gcmv1 8.81 8.88 9.23 T:aes128gcmv1 9.26 9.34 9.72 T:aes256gcmv1 10.09 10.19 10.29 ascon128av12 12.91 12.97 13.10 ascon80pqv12 12.87 13.06 13.17 ascon128v12 16.65 16.94 17.27 T:xoodyakround3 20.27 20.52 20.74 ascon128abi32v12 22.30 22.45 22.58 T:schwaemm256128v2 25.46 25.50 25.67 T:schwaemm128128v2 27.16 27.45 27.91 ascon128bi32v12 29.50 29.79 29.99 T:schwaemm192192v2 32.67 33.03 33.81 T:grain128aeadv2 32.92 33.25 33.37 T:schwaemm256256v2 37.79 38.11 38.27 romulusn 47.36 47.48 47.54 T:giftcofb128v1 52.12 52.23 52.39 romulusm 55.86 56.23 56.64 T:tinyjambu128v2 64.12 64.36 64.80 T:tinyjambu192v2 65.27 66.16 66.59 T:tinyjambu256v2 108.13 108.88 109.60 romulust 119.42 119.81 120.02 T:isapa128av20 119.73 120.47 121.17 T:elephant200v2 150.21 151.05 151.70 T:isapk128av20 349.30 349.75 350.31 T:isapa128v20 980.27 992.94 997.32 T:isapk128v20 1596.95 1597.71 1599.66 T:isapxv20 5400.26 5406.68 5412.94 T:elephant176v2 5980.89 5983.16 5986.89 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 5.79 5.84 5.90 aes256gcmv1 8.82 8.96 9.09 T:aes128gcmv1 9.24 9.31 9.52 T:aes256gcmv1 10.19 10.26 10.36 ascon128av12 12.95 13.01 13.15 ascon128v12 12.89 13.02 13.13 ascon80pqv12 16.55 17.31 17.64 T:xoodyakround3 20.27 20.34 20.55 ascon128abi32v12 22.39 22.50 22.68 T:schwaemm256128v2 25.41 25.65 25.72 T:schwaemm128128v2 27.17 27.48 27.74 ascon128bi32v12 29.38 29.59 29.93 T:schwaemm192192v2 30.97 31.53 32.95 T:schwaemm256256v2 32.53 32.82 33.41 T:grain128aeadv2 37.92 38.09 38.27 romulusn 47.55 47.62 47.80 T:giftcofb128v1 52.11 52.19 52.47 romulusm 55.91 56.16 56.54 T:tinyjambu128v2 64.16 64.37 64.73 T:tinyjambu192v2 65.85 66.48 66.90 T:tinyjambu256v2 68.94 69.41 69.88 romulust 73.61 73.95 74.12 T:isapa128av20 98.52 98.74 99.46 T:isapk128av20 119.49 119.84 120.47 T:elephant200v2 181.95 182.16 182.62 T:isapa128v20 515.15 519.84 524.99 T:isapk128v20 835.47 836.81 837.49 T:isapxv20 5418.86 5467.34 5481.27 T:elephant176v2 5976.64 5980.05 5981.38 T:elephant160v2

amd64; Gracemont (906a4-20); 2022 Intel Core i3-1215U, E cores; 4 x 1600MHz; alder2,1f626960,3300000, supercop-20230530

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 0.49? 0.58? 0.63? T:aes128gcmv1 0.61? 0.67? 0.70? T:aes256gcmv1 1.39 1.40 1.42 aes256gcmv1 6.43 6.45 6.46 ascon128av12 8.91 8.92 8.94 ascon80pqv12 8.92 8.94 8.96 ascon128v12 11.16 11.18 11.19 ascon128abi32v12 16.62 16.65 16.68 ascon128bi32v12 16.55 16.90 17.04 T:schwaemm256128v2 17.31 17.41 17.53 T:xoodyakround3 21.61 21.71 22.51 T:schwaemm256256v2 22.00 22.29 22.35 T:schwaemm192192v2 23.35 23.42 23.61 T:schwaemm128128v2 27.17 27.20 27.27 T:grain128aeadv2 36.51 36.57 36.62 romulusn 36.93 37.07 37.17 T:isapa128v20 37.50 37.57 37.64 T:isapa128av20 38.64 39.03 39.06 T:giftcofb128v1 51.75 51.88 52.77 T:tinyjambu128v2 59.80 59.86 59.88 romulusm 60.07 60.21 60.45 T:isapk128av20 61.10 61.66 62.08 T:tinyjambu256v2 68.99 69.06 69.12 T:tinyjambu192v2 79.86 80.11 80.36 T:isapk128v20 114.66 114.72 114.99 romulust 145.56 146.75 148.62 T:elephant200v2 158.54 159.16 159.53 T:isapxv20 6387.00 6390.74 6424.16 T:elephant176v2 7675.14 7729.57 7876.67 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 0.52? 0.56? 0.58? T:aes128gcmv1 0.54? 0.67? 0.72? T:aes256gcmv1 1.40 1.42 1.43 aes256gcmv1 6.02 6.04 6.05 ascon128av12 8.90 8.92 8.94 ascon128v12 8.92 8.93 8.96 ascon80pqv12 11.10 11.12 11.14 ascon128abi32v12 16.77 16.80 16.82 ascon128bi32v12 16.57 16.88 17.04 T:schwaemm256128v2 17.47 17.61 17.70 T:xoodyakround3 21.63 21.83 22.45 T:schwaemm256256v2 21.95 22.07 22.34 T:schwaemm192192v2 23.38 23.46 23.60 T:schwaemm128128v2 27.00 27.07 27.23 T:grain128aeadv2 36.56 36.58 36.66 romulusn 36.89 37.07 37.18 T:isapa128v20 37.45 37.51 37.59 T:isapa128av20 38.93 39.06 39.09 T:giftcofb128v1 50.73 50.82 51.72 T:tinyjambu128v2 59.67 59.77 59.92 romulusm 60.10 60.23 60.48 T:isapk128av20 60.81 60.93 62.26 T:tinyjambu256v2 68.82 68.88 69.16 T:tinyjambu192v2 79.76 80.01 80.19 T:isapk128v20 114.68 114.74 115.05 romulust 145.04 146.46 148.23 T:elephant200v2 158.54 159.35 159.66 T:isapxv20 6390.67 6424.55 6473.17 T:elephant176v2 7672.56 7785.89 7876.95 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 0.52? 0.57? 0.62? T:aes128gcmv1 0.57? 0.67? 0.70? T:aes256gcmv1 1.41 1.42 1.43 aes256gcmv1 6.03 6.06 6.08 ascon128av12 8.89 8.91 8.94 ascon128v12 8.92 8.94 8.97 ascon80pqv12 11.10 11.11 11.13 ascon128abi32v12 16.77 16.80 16.81 ascon128bi32v12 16.63 16.90 17.03 T:schwaemm256128v2 17.51 17.61 17.72 T:xoodyakround3 18.44 18.49 18.60 T:isapa128v20 21.60 21.83 22.50 T:schwaemm256256v2 21.95 22.27 22.34 T:schwaemm192192v2 23.38 23.44 23.59 T:schwaemm128128v2 24.93 24.96 25.02 T:isapa128av20 27.08 27.12 27.25 T:grain128aeadv2 36.56 36.58 36.59 romulusn 38.93 39.04 39.07 T:giftcofb128v1 39.19 39.23 39.27 romulust 39.83 39.95 40.07 T:isapk128av20 49.95 50.15 50.31 T:isapk128v20 50.64 50.86 51.87 T:tinyjambu128v2 59.79 60.06 60.18 romulusm 60.77 60.90 61.64 T:tinyjambu256v2 68.85 68.91 69.14 T:tinyjambu192v2 92.83 93.36 93.52 T:isapxv20 145.07 146.44 148.23 T:elephant200v2 6423.83 6424.80 6472.88 T:elephant176v2 7675.16 7786.26 7876.68 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.39? 0.42? 0.47? T:aes128gcmv1 0.42? 0.47? 0.51? T:aes256gcmv1 0.92 0.94 0.95 aes256gcmv1 6.21 6.31 6.36 ascon128av12 8.88 8.92 8.93 ascon80pqv12 8.90 8.92 8.93 ascon128v12 11.01 11.04 11.07 ascon128abi32v12 13.27 13.28 13.30 T:xoodyakround3 16.59 16.60 16.62 ascon128bi32v12 16.93 16.95 17.00 T:schwaemm256128v2 21.61 21.77 22.45 T:schwaemm256256v2 21.89 22.08 22.27 T:schwaemm192192v2 23.47 23.51 23.55 T:schwaemm128128v2 27.21 27.26 27.29 T:grain128aeadv2 27.69 27.73 27.77 T:isapa128v20 29.89 29.90 29.94 romulusn 31.21 31.23 31.27 T:isapa128av20 38.98 39.02 39.05 T:giftcofb128v1 41.56 41.59 41.64 romulusm 42.65 43.13 43.36 T:tinyjambu128v2 48.95 49.28 49.46 T:tinyjambu256v2 50.19 50.35 50.51 T:isapk128av20 53.76 53.84 54.26 T:tinyjambu192v2 64.95 65.04 65.22 T:isapk128v20 76.90 77.00 77.04 romulust 109.28 110.20 111.58 T:elephant200v2 126.16 126.36 126.73 T:isapxv20 4776.57 4808.74 4823.26 T:elephant176v2 5793.05 5840.70 5886.74 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.39? 0.42? 0.47? T:aes128gcmv1 0.42? 0.47? 0.51? T:aes256gcmv1 0.91 0.93 0.95 aes256gcmv1 6.01 6.13 6.17 ascon128av12 8.87 8.89 8.92 ascon128v12 8.88 8.91 8.92 ascon80pqv12 11.00 11.02 11.03 ascon128abi32v12 13.00 13.21 13.26 T:xoodyakround3 16.62 16.64 16.66 ascon128bi32v12 16.93 16.95 17.00 T:schwaemm256128v2 21.58 21.76 22.47 T:schwaemm256256v2 21.90 22.05 22.26 T:schwaemm192192v2 23.50 23.53 23.57 T:schwaemm128128v2 27.07 27.14 27.19 T:grain128aeadv2 27.67 27.71 27.74 T:isapa128v20 29.88 29.90 29.94 romulusn 31.22 31.24 31.28 T:isapa128av20 39.02 39.03 39.05 T:giftcofb128v1 41.59 41.65 41.70 romulusm 42.10 42.34 42.88 T:tinyjambu128v2 47.75 48.03 49.03 T:tinyjambu256v2 50.14 50.32 50.46 T:isapk128av20 53.67 53.73 53.84 T:tinyjambu192v2 64.94 65.03 65.21 T:isapk128v20 76.86 76.96 77.05 romulust 109.11 110.04 111.45 T:elephant200v2 126.00 126.42 126.52 T:isapxv20 4775.98 4808.66 4822.99 T:elephant176v2 5792.76 5839.23 5886.64 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.40? 0.43? 0.45? T:aes128gcmv1 0.45 0.48 0.49 T:aes256gcmv1 0.92 0.93 0.93 aes256gcmv1 5.99 6.13 6.16 ascon128av12 8.87 8.88 8.89 ascon128v12 8.88 8.91 8.92 ascon80pqv12 11.01 11.02 11.04 ascon128abi32v12 13.27 13.36 13.43 T:xoodyakround3 16.63 16.64 16.67 ascon128bi32v12 16.93 16.95 16.99 T:schwaemm256128v2 18.43 18.46 18.50 T:isapa128v20 21.57 21.74 22.46 T:schwaemm256256v2 21.90 22.07 22.28 T:schwaemm192192v2 23.49 23.56 23.66 T:schwaemm128128v2 24.98 25.02 25.06 T:isapa128av20 27.12 27.14 27.20 T:grain128aeadv2 29.88 29.92 29.94 romulusn 39.02 39.04 39.05 T:giftcofb128v1 39.13 39.15 39.18 romulust 40.13 40.18 40.23 T:isapk128av20 41.59 41.64 41.67 romulusm 42.09 42.28 42.99 T:tinyjambu128v2 47.23 48.05 48.93 T:tinyjambu256v2 49.99 50.06 50.15 T:isapk128v20 53.57 53.72 53.81 T:tinyjambu192v2 93.15 93.32 93.47 T:isapxv20 109.13 110.04 111.44 T:elephant200v2 4799.07 4808.69 4823.32 T:elephant176v2 5811.90 5839.52 5885.68 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.20? 0.24? 0.29? T:aes128gcmv1 0.23? 0.26? 0.29? T:aes256gcmv1 0.46 0.48 0.48 aes256gcmv1 5.96 6.15 6.19 ascon128av12 8.83 8.86 8.88 ascon128v12 8.87 8.89 8.90 ascon80pqv12 9.01 9.05 9.08 T:xoodyakround3 10.88 10.91 10.93 ascon128abi32v12 16.54 16.54 16.57 ascon128bi32v12 16.83 16.87 16.94 T:schwaemm256128v2 18.38 18.44 18.46 T:isapa128v20 21.56 21.68 22.43 T:schwaemm256256v2 22.06 22.17 22.21 T:schwaemm192192v2 23.21 23.22 23.27 romulusn 23.30 23.31 23.33 romulusm 23.39 23.43 23.51 T:schwaemm128128v2 24.93 24.98 25.01 T:isapa128av20 27.21 27.33 27.41 T:grain128aeadv2 31.93 32.72 33.23 T:tinyjambu256v2 33.42 33.53 33.95 T:tinyjambu128v2 38.41 38.48 38.52 T:tinyjambu192v2 38.94 38.98 39.03 T:giftcofb128v1 39.06 39.10 39.17 romulust 39.83 40.06 40.40 T:isapk128av20 49.89 50.18 50.33 T:isapk128v20 73.21 73.80 74.78 T:elephant200v2 93.18 93.45 93.72 T:isapxv20 3153.63 3158.00 3211.47 T:elephant176v2 3880.27 3886.36 3932.94 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.24? 0.25? 0.27? T:aes128gcmv1 0.22? 0.26? 0.28? T:aes256gcmv1 0.44 0.47 0.47 aes256gcmv1 5.95 5.96 6.18 ascon128av12 8.82 8.83 8.91 ascon128v12 8.85 8.87 8.90 ascon80pqv12 9.03 9.07 9.12 T:xoodyakround3 10.87 10.90 10.93 ascon128abi32v12 16.46 16.49 16.51 ascon128bi32v12 16.83 16.85 16.90 T:schwaemm256128v2 18.35 18.41 18.46 T:isapa128v20 21.56 21.66 22.42 T:schwaemm256256v2 22.08 22.17 22.21 T:schwaemm192192v2 23.20 23.27 23.27 romulusn 23.30 23.33 23.35 romulusm 23.39 23.43 23.49 T:schwaemm128128v2 24.93 24.96 25.02 T:isapa128av20 27.14 27.26 27.33 T:grain128aeadv2 32.87 32.98 33.34 T:tinyjambu256v2 33.44 33.54 34.02 T:tinyjambu128v2 38.42 38.46 38.52 T:tinyjambu192v2 38.93 39.01 39.04 T:giftcofb128v1 39.13 39.22 39.37 romulust 39.82 39.98 40.27 T:isapk128av20 49.97 50.10 50.23 T:isapk128v20 73.26 73.57 74.81 T:elephant200v2 93.05 93.32 93.47 T:isapxv20 3153.86 3157.97 3211.57 T:elephant176v2 3884.12 3888.91 3933.05 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.20? 0.23? 0.28? T:aes128gcmv1 0.21? 0.24? 0.28? T:aes256gcmv1 0.45 0.45 0.46 aes256gcmv1 5.96 5.96 6.18 ascon128av12 8.80 8.84 8.90 ascon128v12 8.85 8.87 8.89 ascon80pqv12 9.02 9.07 9.12 T:xoodyakround3 10.90 10.92 10.94 ascon128abi32v12 16.47 16.49 16.52 ascon128bi32v12 16.85 16.87 16.92 T:schwaemm256128v2 18.38 18.41 18.45 T:isapa128v20 21.55 21.66 22.45 T:schwaemm256256v2 22.06 22.14 22.17 T:schwaemm192192v2 23.21 23.27 23.28 romulusn 23.31 23.32 23.35 romulusm 23.38 23.43 23.50 T:schwaemm128128v2 24.95 24.98 25.03 T:isapa128av20 27.09 27.14 27.24 T:grain128aeadv2 32.93 33.03 33.29 T:tinyjambu256v2 33.44 33.53 34.01 T:tinyjambu128v2 38.32 38.38 38.51 T:tinyjambu192v2 38.95 38.99 39.01 T:giftcofb128v1 39.06 39.11 39.25 romulust 39.82 40.07 40.34 T:isapk128av20 49.98 50.09 50.28 T:isapk128v20 73.19 73.53 74.76 T:elephant200v2 92.72 93.29 94.17 T:isapxv20 3153.64 3157.98 3210.78 T:elephant176v2 3884.05 3886.59 3932.91 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 0.81 0.84 0.87 T:aes128gcmv1 0.86 0.87 0.91 T:aes256gcmv1 1.04 1.05 1.05 aes256gcmv1 6.38 6.46 6.50 ascon128av12 9.04 9.05 9.06 ascon128v12 9.05 9.06 9.07 ascon80pqv12 11.30 11.31 11.32 ascon128abi32v12 13.37 13.39 13.42 T:xoodyakround3 16.86 16.87 16.88 ascon128bi32v12 17.44 17.45 17.49 T:schwaemm256128v2 22.27 22.38 23.03 T:schwaemm256256v2 22.46 22.74 22.98 T:schwaemm192192v2 23.50 23.83 23.88 T:schwaemm128128v2 27.53 27.60 27.65 T:grain128aeadv2 30.20 30.23 30.25 romulusn 34.17 34.18 34.22 T:isapa128av20 39.32 39.36 39.38 T:giftcofb128v1 40.41 40.44 40.48 T:isapa128v20 41.93 41.94 42.03 romulusm 43.07 43.45 43.66 T:tinyjambu128v2 49.37 49.65 49.69 T:tinyjambu256v2 54.10 54.24 54.45 T:tinyjambu192v2 58.27 58.42 58.46 T:isapk128av20 78.07 78.16 78.21 romulust 111.79 112.53 113.79 T:elephant200v2 115.17 115.28 115.42 T:isapk128v20 205.87 206.10 206.56 T:isapxv20 4830.49 4852.50 4896.79 T:elephant176v2 5910.08 5914.77 5961.24 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 0.81 0.82 0.86 T:aes128gcmv1 0.86 0.87 0.89 T:aes256gcmv1 1.04 1.05 1.06 aes256gcmv1 6.21 6.28 6.31 ascon128av12 9.01 9.03 9.06 ascon128v12 9.04 9.05 9.06 ascon80pqv12 11.28 11.29 11.30 ascon128abi32v12 13.20 13.40 13.42 T:xoodyakround3 16.90 16.91 16.92 ascon128bi32v12 17.44 17.45 17.48 T:schwaemm256128v2 22.22 22.31 22.99 T:schwaemm256256v2 22.46 22.71 22.98 T:schwaemm192192v2 23.52 23.83 23.88 T:schwaemm128128v2 27.40 27.47 27.51 T:grain128aeadv2 30.23 30.23 30.27 romulusn 34.19 34.23 34.26 T:isapa128av20 39.34 39.36 39.38 T:giftcofb128v1 40.41 40.42 40.45 T:isapa128v20 42.03 42.10 42.13 romulusm 42.55 42.70 43.18 T:tinyjambu128v2 48.27 48.53 49.26 T:tinyjambu256v2 54.07 54.16 54.26 T:tinyjambu192v2 58.27 58.37 58.43 T:isapk128av20 78.07 78.18 78.22 romulust 111.52 112.38 113.62 T:elephant200v2 115.16 115.27 115.43 T:isapk128v20 205.73 205.81 206.41 T:isapxv20 4828.28 4834.93 4896.84 T:elephant176v2 5909.33 5916.90 5961.35 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 0.81 0.82 0.82 T:aes128gcmv1 0.85 0.86 0.87 T:aes256gcmv1 1.03 1.04 1.04 aes256gcmv1 6.16 6.27 6.30 ascon128av12 9.01 9.02 9.04 ascon128v12 9.02 9.04 9.06 ascon80pqv12 11.26 11.28 11.29 ascon128abi32v12 13.43 13.45 13.50 T:xoodyakround3 16.90 16.90 16.91 ascon128bi32v12 17.43 17.45 17.47 T:schwaemm256128v2 22.26 22.31 23.00 T:schwaemm256256v2 22.45 22.68 23.00 T:schwaemm192192v2 23.53 23.85 23.88 T:schwaemm128128v2 24.91 24.92 24.97 T:isapa128v20 26.66 26.68 26.71 T:isapa128av20 27.45 27.49 27.52 T:grain128aeadv2 30.22 30.26 30.28 romulusn 39.34 39.36 39.37 T:giftcofb128v1 40.28 40.30 40.33 romulust 42.02 42.09 42.13 romulusm 42.54 42.66 43.18 T:tinyjambu128v2 45.42 45.50 45.56 T:isapk128av20 48.26 48.53 49.26 T:tinyjambu256v2 54.05 54.12 54.27 T:tinyjambu192v2 76.69 76.73 76.85 T:isapk128v20 111.48 112.39 113.63 T:elephant200v2 134.06 134.14 134.42 T:isapxv20 4828.31 4834.96 4907.72 T:elephant176v2 5909.61 5916.86 5961.41 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 5.27 5.28 5.38 aes256gcmv1 9.77 10.07 10.63 ascon128av12 10.04 10.27 10.76 T:aes128gcmv1 10.40 10.52 10.98 T:aes256gcmv1 12.05 12.21 12.72 ascon128v12 12.19 12.45 12.77 ascon80pqv12 17.04 17.20 17.88 ascon128abi32v12 19.41 19.52 19.91 T:xoodyakround3 22.69 22.81 23.28 ascon128bi32v12 28.42 28.49 28.90 T:schwaemm256128v2 30.29 30.59 30.87 T:schwaemm128128v2 34.17 34.34 34.63 T:grain128aeadv2 35.48 35.66 36.64 T:schwaemm256256v2 36.52 36.91 37.49 T:schwaemm192192v2 37.88 37.98 37.99 romulusn 46.84 46.95 47.37 T:giftcofb128v1 49.99 50.16 50.91 romulusm 50.60 50.96 51.30 T:tinyjambu128v2 56.73 57.44 58.14 T:tinyjambu256v2 63.38 63.56 64.04 T:tinyjambu192v2 101.30 101.55 101.82 T:isapa128av20 104.55 104.77 104.96 romulust 158.30 159.69 161.37 T:elephant200v2 234.05 235.45 237.83 T:isapk128av20 332.95 333.39 333.83 T:isapa128v20 1255.54 1256.85 1260.70 T:isapk128v20 2012.38 2013.05 2015.54 T:isapxv20 5986.12 5993.44 5999.88 T:elephant176v2 7825.06 7937.88 8021.98 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 5.01 5.07 5.44 aes256gcmv1 9.64 9.91 10.30 ascon128av12 9.92 10.21 10.59 T:aes128gcmv1 10.26 10.66 11.02 T:aes256gcmv1 11.98 12.23 12.60 ascon128v12 12.04 12.25 12.73 ascon80pqv12 17.07 17.12 17.95 ascon128abi32v12 19.15 19.20 19.80 T:xoodyakround3 22.93 23.10 23.86 ascon128bi32v12 28.42 28.53 28.95 T:schwaemm256128v2 30.37 30.44 30.76 T:schwaemm128128v2 34.38 34.48 34.84 T:grain128aeadv2 35.47 35.58 36.66 T:schwaemm256256v2 36.77 36.88 37.03 T:schwaemm192192v2 38.12 38.12 38.21 romulusn 47.09 47.15 47.24 T:giftcofb128v1 50.27 50.88 51.12 T:tinyjambu128v2 52.35 52.42 52.59 romulusm 57.19 57.62 57.88 T:tinyjambu256v2 63.55 64.75 65.34 T:tinyjambu192v2 101.73 101.88 102.11 T:isapa128av20 104.62 104.92 105.18 romulust 158.21 159.12 160.82 T:elephant200v2 233.91 234.38 234.94 T:isapk128av20 333.66 334.06 334.51 T:isapa128v20 1255.01 1256.61 1259.20 T:isapk128v20 2012.28 2012.80 2013.59 T:isapxv20 5986.41 5997.51 6005.74 T:elephant176v2 7824.55 7939.28 8022.97 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 5.02 5.12 5.22 aes256gcmv1 9.51 9.67 9.86 ascon128av12 9.99 10.23 10.55 T:aes128gcmv1 10.35 10.58 11.32 T:aes256gcmv1 11.95 12.10 12.16 ascon128v12 12.09 12.21 12.26 ascon80pqv12 17.05 17.12 17.32 ascon128abi32v12 19.40 19.85 19.91 T:xoodyakround3 22.87 22.91 23.15 ascon128bi32v12 28.38 28.41 28.48 T:schwaemm256128v2 30.23 30.35 30.45 T:schwaemm128128v2 34.38 34.47 34.70 T:grain128aeadv2 35.56 35.91 36.91 T:schwaemm256256v2 36.41 36.52 36.88 T:schwaemm192192v2 38.13 38.15 38.16 romulusn 47.09 47.20 47.32 T:giftcofb128v1 50.12 50.24 51.12 T:tinyjambu128v2 52.36 52.42 52.49 romulusm 56.95 57.68 57.77 T:tinyjambu256v2 63.30 63.40 63.53 T:tinyjambu192v2 64.20 64.57 64.69 T:isapa128av20 65.77 65.90 66.36 romulust 157.55 158.23 158.76 T:isapk128av20 158.25 159.27 160.81 T:elephant200v2 173.87 174.10 174.18 T:isapa128v20 681.17 681.70 682.34 T:isapk128v20 1052.22 1052.77 1053.38 T:isapxv20 5986.74 6006.59 6030.94 T:elephant176v2 7879.18 7938.47 8019.87 T:elephant160v2

amd64; Golden Cove (90675-00); 2022 Intel Core i3-12100; 4 x 3300MHz; alder, supercop-20230530

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 0.51 0.53 0.54 T:aes128gcmv1 0.61 0.62 0.64 T:aes256gcmv1 1.53 1.54 1.56 aes256gcmv1 6.52 6.56 6.61 ascon128av12 9.81 9.86 9.90 ascon128v12 9.63 9.87 10.00 ascon80pqv12 13.03 13.06 13.11 ascon128abi32v12 13.39 13.43 13.47 T:schwaemm256128v2 15.32 15.42 15.59 T:xoodyakround3 17.66 17.77 17.84 T:schwaemm192192v2 18.88 18.97 19.74 T:schwaemm256256v2 19.81 19.85 19.91 T:schwaemm128128v2 19.87 19.92 19.99 ascon128bi32v12 24.43 24.47 24.50 T:grain128aeadv2 38.46 38.50 38.55 romulusn 38.99 39.11 39.24 T:isapa128av20 39.38 39.61 39.84 T:isapa128v20 39.81 39.86 39.89 T:giftcofb128v1 49.18 49.61 49.80 T:isapk128av20 55.02 55.11 55.15 T:tinyjambu128v2 61.74 61.82 61.87 romulusm 66.42 66.61 66.75 T:tinyjambu192v2 67.10 67.49 68.93 T:isapk128v20 71.09 71.20 71.26 T:tinyjambu256v2 110.22 110.37 111.11 T:elephant200v2 119.36 119.41 119.49 romulust 119.90 120.28 120.97 T:isapxv20 5782.18 5822.95 5851.29 T:elephant176v2 5888.09 5889.92 5891.54 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 0.48? 0.51? 0.54? T:aes128gcmv1 0.57 0.59 0.61 T:aes256gcmv1 1.40 1.42 1.43 aes256gcmv1 6.55 6.64 6.69 ascon128av12 9.77 9.82 9.85 ascon128v12 9.69 9.84 10.06 ascon80pqv12 13.06 13.08 13.12 ascon128abi32v12 13.33 13.42 13.49 T:schwaemm256128v2 15.14 15.23 15.33 T:xoodyakround3 17.68 17.74 17.77 T:schwaemm192192v2 18.89 19.09 19.42 T:schwaemm256256v2 19.77 19.83 19.88 T:schwaemm128128v2 19.95 20.05 20.11 ascon128bi32v12 23.68 23.70 23.74 T:grain128aeadv2 38.59 38.61 38.64 romulusn 39.30 39.54 39.82 T:isapa128v20 39.65 39.73 39.80 T:isapa128av20 39.77 39.81 39.87 T:giftcofb128v1 49.22 49.39 49.70 T:isapk128av20 54.84 54.87 54.92 T:tinyjambu128v2 61.79 61.90 61.96 romulusm 66.48 66.54 66.62 T:tinyjambu192v2 66.02 67.30 68.61 T:isapk128v20 70.65 70.95 71.53 T:tinyjambu256v2 109.96 111.01 111.18 T:elephant200v2 119.31 119.42 119.58 romulust 120.40 120.57 120.89 T:isapxv20 5765.66 5791.85 5838.45 T:elephant176v2 5887.50 5888.85 5891.20 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 0.51 0.52 0.54 T:aes128gcmv1 0.59 0.60 0.62 T:aes256gcmv1 1.41 1.42 1.43 aes256gcmv1 6.54 6.60 6.68 ascon128av12 9.63 9.75 9.93 ascon80pqv12 9.76 9.79 9.82 ascon128v12 13.08 13.12 13.15 ascon128abi32v12 13.39 13.43 13.49 T:schwaemm256128v2 15.19 15.28 15.38 T:xoodyakround3 17.67 17.71 17.78 T:schwaemm192192v2 19.43 19.52 19.58 T:isapa128v20 19.77 19.82 19.85 T:schwaemm128128v2 19.96 20.06 20.12 ascon128bi32v12 19.15 20.37 20.41 T:schwaemm256256v2 23.67 23.72 23.74 T:grain128aeadv2 26.34 26.41 26.47 T:isapa128av20 33.15 33.19 33.22 T:isapk128av20 38.55 38.58 38.62 romulusn 39.81 39.85 39.91 T:giftcofb128v1 41.28 41.38 41.47 romulust 40.18 41.42 42.10 T:isapk128v20 54.84 54.90 55.04 T:tinyjambu128v2 61.65 61.84 61.94 romulusm 66.38 66.52 66.57 T:tinyjambu192v2 70.82 71.00 71.29 T:tinyjambu256v2 72.11 72.48 72.87 T:isapxv20 110.63 111.09 111.40 T:elephant200v2 5776.60 5808.11 5844.45 T:elephant176v2 5884.75 5887.90 5891.25 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.36 0.38 0.38 T:aes128gcmv1 0.41 0.42 0.43 T:aes256gcmv1 0.91 0.92 0.93 aes256gcmv1 6.53 6.55 6.58 ascon128av12 9.59 9.67 9.78 ascon80pqv12 9.80 9.82 9.84 ascon128v12 11.47 11.52 11.59 T:xoodyakround3 13.28 13.32 13.37 ascon128abi32v12 13.34 13.37 13.44 T:schwaemm256128v2 17.63 17.72 17.82 T:schwaemm192192v2 18.87 19.01 19.06 T:schwaemm256256v2 19.83 19.86 19.88 T:schwaemm128128v2 20.16 20.21 20.28 ascon128bi32v12 24.32 24.34 24.44 T:grain128aeadv2 29.22 29.44 29.71 T:isapa128v20 30.85 30.89 30.91 romulusn 32.44 32.49 32.82 T:isapa128av20 39.77 39.80 39.84 T:giftcofb128v1 41.58 41.82 42.07 T:isapk128av20 42.48 42.52 42.56 romulusm 45.01 45.04 45.07 T:tinyjambu128v2 52.12 52.22 52.27 T:tinyjambu192v2 53.82 53.89 53.95 T:tinyjambu256v2 54.30 54.96 55.46 T:isapk128v20 80.41 80.45 80.49 romulust 82.35 82.52 83.36 T:elephant200v2 96.46 96.89 97.20 T:isapxv20 4303.11 4329.37 4352.59 T:elephant176v2 4409.47 4413.66 4414.88 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.35 0.37 0.38 T:aes128gcmv1 0.40 0.42 0.43 T:aes256gcmv1 0.85 0.86 0.87 aes256gcmv1 6.50 6.54 6.63 ascon128av12 9.65 9.74 9.80 ascon80pqv12 9.74 9.79 9.81 ascon128v12 11.36 11.41 11.50 T:xoodyakround3 13.26 13.34 13.42 ascon128abi32v12 13.31 13.36 13.41 T:schwaemm256128v2 17.66 17.72 17.75 T:schwaemm192192v2 18.92 19.06 20.56 T:schwaemm256256v2 19.79 19.83 19.85 T:schwaemm128128v2 20.00 20.05 20.14 ascon128bi32v12 23.91 23.93 23.95 T:grain128aeadv2 29.26 29.42 29.57 T:isapa128v20 30.90 30.94 30.97 romulusn 32.92 32.99 33.04 T:isapa128av20 39.77 39.80 39.85 T:giftcofb128v1 41.36 41.56 41.80 T:isapk128av20 42.51 42.54 42.62 romulusm 44.92 44.99 45.04 T:tinyjambu128v2 52.12 52.16 52.19 T:tinyjambu192v2 53.73 54.00 54.10 T:tinyjambu256v2 53.09 54.17 55.03 T:isapk128v20 80.38 80.45 80.48 romulust 82.89 82.97 83.30 T:elephant200v2 96.13 96.33 96.50 T:isapxv20 4307.86 4335.20 4352.18 T:elephant176v2 4414.00 4415.64 4417.21 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.36? 0.37? 0.41? T:aes128gcmv1 0.40? 0.42? 0.46? T:aes256gcmv1 0.85 0.86 0.86 aes256gcmv1 6.58 6.62 6.64 ascon128av12 9.75 9.78 9.80 ascon128v12 9.67 9.79 9.89 ascon80pqv12 11.38 11.42 11.52 T:xoodyakround3 13.30 13.34 13.37 ascon128abi32v12 13.33 13.36 13.39 T:schwaemm256128v2 17.66 17.69 17.72 T:schwaemm192192v2 18.97 19.03 19.37 T:schwaemm256256v2 19.44 19.47 19.51 T:isapa128v20 19.77 19.81 19.83 T:schwaemm128128v2 20.02 20.07 20.11 ascon128bi32v12 23.92 23.94 23.96 T:grain128aeadv2 26.19 26.34 26.42 T:isapa128av20 30.89 30.93 30.97 romulusn 33.08 33.24 33.48 T:isapk128av20 39.78 39.81 39.84 T:giftcofb128v1 41.30 41.36 41.45 romulust 41.51 41.72 42.06 T:isapk128v20 42.48 42.52 42.56 romulusm 44.91 44.94 44.99 T:tinyjambu128v2 52.09 52.17 52.24 T:tinyjambu192v2 53.63 53.85 53.91 T:tinyjambu256v2 72.30 72.44 73.39 T:isapxv20 82.58 82.84 83.10 T:elephant200v2 4304.88 4317.24 4335.35 T:elephant176v2 4413.32 4414.69 4416.16 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.22? 0.24? 0.26? T:aes128gcmv1 0.23 0.24 0.25 T:aes256gcmv1 0.28? 0.31? 0.33? aes256gcmv1 6.49 6.54 6.59 ascon128av12 7.61 7.68 7.83 T:xoodyakround3 9.69 9.75 9.78 ascon128v12 9.61 9.82 10.27 ascon80pqv12 13.24 13.28 13.32 T:schwaemm256128v2 13.40 13.55 13.66 ascon128abi32v12 17.57 17.66 17.74 T:schwaemm192192v2 18.89 19.00 20.58 T:schwaemm256256v2 19.41 19.52 19.57 T:isapa128v20 19.75 19.78 19.82 T:schwaemm128128v2 20.21 20.37 20.44 ascon128bi32v12 23.20 23.24 23.29 romulusn 23.22 23.26 23.31 romulusm 24.33 24.42 24.49 T:grain128aeadv2 26.24 26.32 26.42 T:isapa128av20 32.88 33.38 33.89 T:isapk128av20 34.82 34.88 34.95 T:tinyjambu128v2 36.28 36.32 36.41 T:tinyjambu256v2 37.72 37.83 37.88 T:tinyjambu192v2 39.78 39.83 39.89 T:giftcofb128v1 41.32 41.39 41.46 romulust 40.71 41.98 43.45 T:isapk128v20 55.84 55.89 56.51 T:elephant200v2 72.21 72.46 72.67 T:isapxv20 2845.86 2871.73 2882.04 T:elephant176v2 2940.18 2941.78 2943.26 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.21? 0.23? 0.25? T:aes256gcmv1 0.22? 0.23? 0.25? T:aes128gcmv1 0.29 0.31 0.32 aes256gcmv1 6.42 6.50 6.55 ascon128av12 7.58 7.69 7.74 T:xoodyakround3 9.57 9.63 9.81 ascon80pqv12 9.72 9.75 9.80 ascon128v12 13.25 13.28 13.36 T:schwaemm256128v2 13.59 13.67 13.71 ascon128abi32v12 17.61 17.66 17.72 T:schwaemm192192v2 18.78 19.24 20.51 T:schwaemm256256v2 19.42 19.48 19.52 T:isapa128v20 19.73 19.79 19.82 T:schwaemm128128v2 20.04 20.14 20.18 ascon128bi32v12 23.23 23.27 23.32 romulusn 23.26 23.31 23.34 romulusm 24.16 24.23 24.29 T:grain128aeadv2 25.97 26.30 26.41 T:isapa128av20 32.60 33.05 33.86 T:isapk128av20 34.83 34.87 35.02 T:tinyjambu128v2 36.29 36.33 36.41 T:tinyjambu256v2 37.38 37.57 37.63 T:tinyjambu192v2 39.78 39.82 39.88 T:giftcofb128v1 41.30 41.41 41.46 romulust 40.82 41.87 42.75 T:isapk128v20 55.85 55.92 56.16 T:elephant200v2 71.99 72.26 72.55 T:isapxv20 2841.50 2846.47 2848.25 T:elephant176v2 2938.46 2939.43 2940.70 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.21 0.22 0.23 T:aes128gcmv1 0.20? 0.23? 0.24? T:aes256gcmv1 0.30 0.31 0.33 aes256gcmv1 6.43 6.53 6.58 ascon128av12 7.57 7.69 7.79 T:xoodyakround3 9.60 9.65 9.73 ascon80pqv12 9.71 9.74 9.76 ascon128v12 13.25 13.32 13.40 T:schwaemm256128v2 13.58 13.65 13.70 ascon128abi32v12 17.55 17.62 17.70 T:schwaemm192192v2 18.80 19.24 20.26 T:schwaemm256256v2 19.42 19.48 19.56 T:isapa128v20 19.76 19.81 19.84 T:schwaemm128128v2 20.02 20.10 20.19 ascon128bi32v12 23.21 23.24 23.28 romulusm 23.23 23.28 23.32 romulusn 24.15 24.19 24.29 T:grain128aeadv2 26.26 26.34 26.39 T:isapa128av20 32.80 33.15 33.48 T:isapk128av20 34.85 34.89 34.93 T:tinyjambu128v2 36.29 36.34 36.39 T:tinyjambu256v2 37.53 37.59 37.69 T:tinyjambu192v2 39.81 39.83 39.88 T:giftcofb128v1 41.33 41.38 41.46 romulust 41.32 41.69 42.27 T:isapk128v20 55.75 55.81 56.03 T:elephant200v2 72.53 72.76 73.60 T:isapxv20 2856.28 2880.95 2887.91 T:elephant176v2 2939.78 2941.19 2942.07 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 0.72 0.73 0.75 T:aes128gcmv1 0.78 0.79 0.80 T:aes256gcmv1 1.06 1.06 1.07 aes256gcmv1 6.66 6.69 6.71 ascon128av12 9.71 9.74 9.79 ascon80pqv12 9.90 9.93 9.96 ascon128v12 11.62 11.65 11.74 T:xoodyakround3 13.57 13.63 13.67 ascon128abi32v12 13.69 13.74 13.76 T:schwaemm256128v2 18.17 18.21 18.26 T:schwaemm192192v2 20.07 20.11 20.13 T:schwaemm128128v2 20.56 20.59 20.60 ascon128bi32v12 19.84 20.78 21.03 T:schwaemm256256v2 24.68 24.75 24.78 T:grain128aeadv2 31.15 31.17 31.18 romulusn 36.15 36.45 36.51 T:isapa128av20 40.11 40.14 40.18 T:giftcofb128v1 42.85 42.88 42.93 romulusm 42.79 42.96 43.04 T:isapa128v20 45.48 45.53 45.59 T:tinyjambu128v2 46.37 46.58 46.83 T:isapk128av20 52.72 52.75 52.79 T:tinyjambu192v2 54.30 54.33 54.38 T:tinyjambu256v2 81.62 81.63 81.67 romulust 84.31 84.35 84.51 T:elephant200v2 93.41 93.72 94.10 T:isapk128v20 159.55 160.42 160.88 T:isapxv20 4361.30 4380.73 4381.49 T:elephant176v2 4463.22 4464.75 4466.11 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 0.72 0.73 0.73 T:aes128gcmv1 0.78 0.78 0.80 T:aes256gcmv1 1.00 1.01 1.01 aes256gcmv1 6.69 6.71 6.74 ascon128av12 9.78 9.82 9.91 ascon80pqv12 9.87 9.89 9.92 ascon128v12 11.50 11.54 11.59 T:xoodyakround3 13.59 13.65 13.68 ascon128abi32v12 13.70 13.74 13.77 T:schwaemm256128v2 18.09 18.14 18.18 T:schwaemm192192v2 20.06 20.08 20.11 T:schwaemm128128v2 20.31 20.37 20.46 ascon128bi32v12 20.74 21.00 21.07 T:schwaemm256256v2 24.25 24.28 24.30 T:grain128aeadv2 31.22 31.23 31.26 romulusn 36.37 36.68 36.70 T:isapa128av20 40.13 40.16 40.18 T:giftcofb128v1 42.66 42.72 42.80 T:isapa128v20 42.92 43.00 43.08 romulusm 45.36 45.39 45.41 T:tinyjambu128v2 46.23 46.50 46.83 T:isapk128av20 52.65 52.71 52.73 T:tinyjambu192v2 54.23 54.31 54.42 T:tinyjambu256v2 81.59 81.65 81.69 romulust 84.44 84.88 84.94 T:elephant200v2 92.77 93.40 94.14 T:isapk128v20 160.01 160.13 160.29 T:isapxv20 4343.90 4365.62 4381.48 T:elephant176v2 4463.30 4464.09 4465.04 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 0.72 0.73 0.77 T:aes128gcmv1 0.78 0.78 0.81 T:aes256gcmv1 1.00 1.01 1.01 aes256gcmv1 6.68 6.72 6.77 ascon128av12 9.84 9.90 9.92 ascon80pqv12 9.88 9.90 9.92 ascon128v12 11.51 11.56 11.64 T:xoodyakround3 13.61 13.64 13.67 ascon128abi32v12 13.76 13.78 13.81 T:schwaemm256128v2 18.05 18.09 18.13 T:schwaemm192192v2 19.55 19.62 21.00 T:schwaemm256256v2 20.04 20.08 20.10 T:schwaemm128128v2 20.34 20.41 20.45 ascon128bi32v12 24.28 24.30 24.32 T:grain128aeadv2 26.22 26.25 26.29 T:isapa128v20 28.32 28.40 28.44 T:isapa128av20 31.20 31.23 31.25 romulusn 36.16 36.19 36.34 T:isapk128av20 40.15 40.18 40.20 T:giftcofb128v1 42.56 42.58 42.63 romulust 42.88 42.91 42.98 romulusm 45.43 45.44 45.48 T:tinyjambu128v2 52.65 52.70 52.72 T:tinyjambu192v2 54.20 54.32 54.40 T:tinyjambu256v2 61.49 61.72 61.95 T:isapk128v20 84.21 84.30 84.39 T:elephant200v2 105.15 106.28 107.23 T:isapxv20 4344.24 4391.36 4396.67 T:elephant176v2 4461.93 4463.94 4464.49 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 5.62 5.69 5.76 aes256gcmv1 8.95 9.25 9.41 T:aes128gcmv1 9.37 9.48 9.73 T:aes256gcmv1 10.17 10.48 10.59 ascon128av12 12.82 12.96 13.19 ascon80pqv12 12.98 13.10 13.14 ascon128v12 16.88 17.30 17.94 T:xoodyakround3 20.06 20.23 20.39 ascon128abi32v12 22.34 22.55 22.80 T:schwaemm256128v2 25.58 25.74 25.86 T:schwaemm128128v2 27.07 27.23 27.55 ascon128bi32v12 29.02 29.39 29.88 T:schwaemm192192v2 30.91 31.36 33.31 T:schwaemm256256v2 32.30 32.53 32.86 T:grain128aeadv2 37.42 37.64 37.77 romulusn 47.33 47.47 47.62 T:giftcofb128v1 50.02 50.22 50.30 romulusm 55.84 55.94 56.39 T:tinyjambu128v2 64.46 64.55 64.91 T:tinyjambu192v2 65.84 66.33 66.90 T:tinyjambu256v2 108.14 108.39 108.48 romulust 118.59 119.14 119.85 T:elephant200v2 118.88 119.27 119.52 T:isapa128av20 150.28 150.77 151.48 T:isapk128av20 349.19 349.62 350.01 T:isapa128v20 976.62 981.01 984.39 T:isapk128v20 1599.10 1603.16 1605.46 T:isapxv20 5458.95 5466.06 5468.82 T:elephant176v2 5977.42 5979.95 5984.32 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 5.76 5.86 5.93 aes256gcmv1 9.00 9.33 9.45 T:aes128gcmv1 9.41 9.53 9.80 T:aes256gcmv1 10.13 10.26 10.35 ascon128av12 12.85 12.95 13.22 ascon80pqv12 12.90 13.05 13.31 ascon128v12 16.77 16.98 17.22 T:xoodyakround3 20.24 20.45 20.73 ascon128abi32v12 22.37 22.58 22.87 T:schwaemm256128v2 25.37 25.51 25.77 T:schwaemm128128v2 26.91 27.39 27.87 ascon128bi32v12 29.35 29.64 29.98 T:schwaemm192192v2 31.98 32.11 32.20 T:grain128aeadv2 31.39 32.35 33.60 T:schwaemm256256v2 37.94 38.05 38.37 romulusn 47.40 47.56 47.63 T:giftcofb128v1 51.89 52.27 52.52 romulusm 55.88 56.25 56.49 T:tinyjambu128v2 64.15 64.30 64.73 T:tinyjambu192v2 65.55 65.98 66.16 T:tinyjambu256v2 108.42 108.75 109.52 romulust 119.51 119.77 120.05 T:isapa128av20 119.34 120.16 120.76 T:elephant200v2 151.09 151.46 151.77 T:isapk128av20 349.06 349.80 349.96 T:isapa128v20 968.84 972.01 982.87 T:isapk128v20 1597.70 1599.38 1600.70 T:isapxv20 5408.73 5458.53 5468.74 T:elephant176v2 5977.74 5981.10 5984.07 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 5.77 5.84 5.88 aes256gcmv1 8.92 9.04 9.13 T:aes128gcmv1 9.38 9.48 9.59 T:aes256gcmv1 10.16 10.33 10.46 ascon128av12 12.83 13.04 13.16 ascon128v12 12.88 13.08 13.16 ascon80pqv12 16.68 17.27 17.59 T:xoodyakround3 20.27 20.32 20.77 ascon128abi32v12 22.23 22.47 22.57 T:schwaemm256128v2 25.42 25.56 25.66 T:schwaemm128128v2 27.20 27.45 27.58 ascon128bi32v12 29.38 29.51 29.69 T:schwaemm192192v2 31.91 32.01 32.15 T:grain128aeadv2 32.47 32.78 33.42 T:schwaemm256256v2 37.94 38.14 38.22 romulusn 47.48 47.68 47.73 T:giftcofb128v1 51.99 52.24 52.36 romulusm 55.66 56.23 56.50 T:tinyjambu128v2 64.05 64.33 64.59 T:tinyjambu192v2 65.95 66.38 66.77 T:tinyjambu256v2 68.67 69.45 69.98 romulust 73.64 73.98 74.20 T:isapa128av20 98.63 98.93 99.34 T:isapk128av20 119.49 119.67 120.41 T:elephant200v2 182.04 182.39 182.83 T:isapa128v20 509.97 516.74 519.90 T:isapk128v20 835.30 838.27 839.02 T:isapxv20 5437.45 5454.60 5458.91 T:elephant176v2 5968.20 5973.80 5977.41 T:elephant160v2