VAMPIRE

eBACS: ECRYPT Benchmarking of Cryptographic Systems


ECRYPT II
General information:IntroductioneBASHeBASCeBAEADeBATSSUPERCOPXBXComputersArch
How to submit new software:Tipshashstreamaeaddhkemencryptsign
List of primitives measured:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
Measurements:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
List of subroutines:verifydecodeencodesortcorehashblocksxofscalarmult

Measurements of NISTLWC cipher candidates on one machine: aarch64; Cortex-A72 (410fd083); 2019 Broadcom BCM2711; 4 x 1500MHz; pi4b, supercop-20250922

[Page version: 20251103 11:56:58]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.


Test results

Graphs: (bytes,cycles)
Cycles/byte for long+0 encrypt
25%50%75%aead
6.936.946.95ascon128av12
10.3710.3810.39ascon80pqv12
10.3710.3810.38ascon128v12
14.4414.4814.49ascon128abi32v12
21.1221.1321.51ascon128bi32v12
23.0923.1423.34T:xoodyakround3
24.5224.5724.70T:schwaemm256128v2
28.61?31.67?35.90?T:aes256gcmv1
32.0732.0832.27T:schwaemm128128v2
32.2232.2732.34T:schwaemm192192v2
36.0136.0136.29T:schwaemm256256v2
36.0536.0836.59T:giftcofb128v1
38.9739.0039.10T:isapa128av20
43.7344.2345.63T:isapa128v20
48.4648.8050.80T:aes128gcmv1
55.0055.0155.13T:tinyjambu128v2
63.2563.2663.60T:tinyjambu192v2
64.5264.5564.91T:romulusn
70.2570.2773.55T:tinyjambu256v2
94.6596.73100.81T:isapk128av20
113.27113.53116.52romulusn
125.21131.70133.44T:isapk128v20
169.86172.88173.88romulusm
193.25197.28197.81T:elephant200v2
224.24226.78232.28T:isapxv20
339.63340.45341.70T!!!romulust
7010.437017.147021.51T:elephant160v2
7519.577524.037531.08T:elephant176v2
23221.8723252.0923262.50aes256gcmv1
Cycles/byte for long+0 decrypt
25%50%75%aead
6.936.946.95ascon128av12
10.2510.2510.26ascon80pqv12
10.2410.2510.32ascon128v12
14.3714.4114.42ascon128abi32v12
20.3720.3820.38ascon128bi32v12
22.2622.3022.35T:xoodyakround3
24.1924.2124.23T:schwaemm256128v2
31.9631.9832.03T:schwaemm192192v2
32.0132.0132.16T:schwaemm128128v2
33.37?33.59?37.50?T:aes256gcmv1
35.7335.7735.96T:giftcofb128v1
35.9735.9836.11T:schwaemm256256v2
38.9939.0139.03T:isapa128av20
44.1244.1544.98T:isapa128v20
48.3948.4950.71T:aes128gcmv1
54.9855.0355.22T:tinyjambu128v2
63.2563.3364.47T:tinyjambu192v2
64.0864.1464.39T:romulusn
70.2570.2670.63T:tinyjambu256v2
95.0395.74100.76T:isapk128av20
113.60113.71117.01romulusn
125.07132.08132.85T:isapk128v20
169.85173.73174.48romulusm
193.54196.86197.42T:elephant200v2
224.66227.62232.52T:isapxv20
339.26340.50344.06T!!!romulust
7008.067014.177059.48T:elephant160v2
7522.357526.887531.22T:elephant176v2
23216.9923223.5623241.20aes256gcmv1
Cycles/byte for long+0 forgery
25%50%75%aead
6.956.956.95ascon128av12
10.2610.2610.26ascon128v12
10.2610.2610.26ascon80pqv12
14.3714.4214.42ascon128abi32v12
20.3820.3820.38ascon128bi32v12
22.0422.2522.32T:isapa128v20
22.3522.3722.40T:xoodyakround3
24.2024.2124.22T:schwaemm256128v2
25.8425.8825.90T:isapa128av20
31.9831.9832.00T:schwaemm192192v2
32.0132.0132.22T:schwaemm128128v2
29.99?34.26?38.67?T:aes256gcmv1
35.7635.7736.05T:giftcofb128v1
35.9835.9936.05T:schwaemm256256v2
48.4248.7551.45T:aes128gcmv1
55.0255.0255.11T:tinyjambu128v2
62.8763.1368.75T:isapk128av20
63.2363.3263.73T:tinyjambu192v2
64.0564.1168.12T:romulusn
70.2570.2770.59T:tinyjambu256v2
78.4479.1284.41T:isapk128v20
113.11113.27117.36T!!!romulust
113.67113.87117.83romulusn
129.33133.37134.33T:isapxv20
169.87172.93173.82romulusm
193.59197.31198.05T:elephant200v2
365.49370.03372.68aes256gcmv1
7010.457018.587030.55T:elephant160v2
7520.827525.827532.60T:elephant176v2
Cycles/byte for long+long encrypt
25%50%75%aead
6.896.916.92ascon128av12
10.3110.3210.33ascon128v12
10.4310.4410.48ascon80pqv12
14.1614.1814.26ascon128abi32v12
17.4917.5117.53T:xoodyakround3
18.25?18.86?21.38?T:aes256gcmv1
20.8620.8820.95ascon128bi32v12
24.3024.3124.40T:schwaemm256128v2
30.4631.0233.11T:aes128gcmv1
31.9531.9832.17T:schwaemm192192v2
32.1132.1434.07T:schwaemm128128v2
32.4332.4534.15T:isapa128av20
33.1933.3335.89T:isapa128v20
35.8135.8436.05T:schwaemm256256v2
35.8935.9536.20T:giftcofb128v1
45.8445.9047.76T:tinyjambu128v2
50.2550.2952.37T:tinyjambu192v2
52.7552.7954.83T:tinyjambu256v2
56.6757.1058.77T:romulusn
79.4082.2182.55T:isapk128av20
85.0086.4887.17romulusn
102.09103.18108.19T:isapk128v20
114.34114.69115.46romulusm
146.44146.64146.96T:elephant200v2
179.33180.11182.07T:isapxv20
226.74228.51229.21T!!!romulust
5262.605273.065278.84T:elephant160v2
5633.945638.105649.94T:elephant176v2
11793.6711798.5111804.39aes256gcmv1
Cycles/byte for long+long decrypt
25%50%75%aead
6.846.856.88ascon128av12
10.2510.2610.39ascon80pqv12
10.3110.3210.36ascon128v12
14.0714.1814.20ascon128abi32v12
17.0517.0817.26T:xoodyakround3
19.30?20.13?22.67?T:aes256gcmv1
20.44?20.46?22.81?ascon128bi32v12
24.1324.1524.33T:schwaemm256128v2
30.4730.8431.98T:aes128gcmv1
31.8231.8733.88T:schwaemm192192v2
32.0932.1034.13T:schwaemm128128v2
32.4332.4832.88T:isapa128av20
33.0833.6735.76T:isapa128v20
35.7335.7937.33T:giftcofb128v1
35.7935.8136.11T:schwaemm256256v2
45.8445.9647.88T:tinyjambu128v2
50.2650.3052.33T:tinyjambu192v2
52.7652.7954.87T:tinyjambu256v2
56.4256.8259.44T:romulusn
79.4782.1682.65T:isapk128av20
85.1086.8887.24romulusn
102.34105.42106.03T:isapk128v20
114.11115.03115.57romulusm
146.46147.00147.67T:elephant200v2
179.56180.44183.04T:isapxv20
226.38227.90228.43T!!!romulust
5270.485275.355279.81T:elephant160v2
5633.605637.855640.74T:elephant176v2
11795.0411800.5711811.33aes256gcmv1
Cycles/byte for long+long forgery
25%50%75%aead
6.856.856.85ascon128av12
10.2610.2610.26ascon80pqv12
10.3110.3210.32ascon128v12
14.1614.1814.19ascon128abi32v12
17.1017.1217.15T:xoodyakround3
18.66?20.15?23.23?T:aes256gcmv1
20.4520.4520.60ascon128bi32v12
22.0922.4224.42T:isapa128v20
24.1424.1524.52T:schwaemm256128v2
25.8725.8826.09T:isapa128av20
30.6431.3333.29T:aes128gcmv1
31.8331.8632.47T:schwaemm192192v2
32.0932.1032.12T:schwaemm128128v2
35.7435.8337.81T:giftcofb128v1
35.8035.8537.74T:schwaemm256256v2
45.8445.9247.98T:tinyjambu128v2
50.2750.5452.63T:tinyjambu192v2
52.7552.8954.76T:tinyjambu256v2
56.4656.5658.63T:romulusn
63.2666.0266.47T:isapk128av20
76.2881.7482.29T:isapk128v20
85.0386.3687.15romulusn
113.91114.96115.37romulusm
114.83114.99115.40T!!!romulust
130.23133.01134.17T:isapxv20
146.44146.69147.20T:elephant200v2
367.66370.16372.08aes256gcmv1
5263.355272.765277.44T:elephant160v2
5635.355638.005651.93T:elephant176v2
Cycles/byte for 0+long encrypt
25%50%75%aead
5.195.355.61T:aes256gcmv1
6.876.886.88ascon128av12
10.2410.2510.26ascon128v12
10.4910.5010.62ascon80pqv12
11.8511.8711.89T:xoodyakround3
12.3512.9613.02T:aes128gcmv1
13.9113.9214.01ascon128abi32v12
20.6220.6320.92ascon128bi32v12
22.2422.2522.61T:isapa128v20
24.0724.0824.14T:schwaemm256128v2
25.8725.8825.93T:isapa128av20
31.6431.6931.77T:schwaemm192192v2
32.0732.1932.20T:schwaemm128128v2
35.2535.2535.35T:tinyjambu256v2
35.6335.6335.80T:schwaemm256256v2
35.6935.7335.86T:giftcofb128v1
36.6736.6936.73T:tinyjambu128v2
37.2437.2637.34T:tinyjambu192v2
48.7448.7948.96T:romulusn
56.2756.3856.60romulusm
56.3056.6456.68romulusn
63.2463.6869.36T:isapk128av20
77.7984.0485.79T:isapk128v20
96.0996.3499.82T:elephant200v2
112.81113.03117.27T!!!romulust
125.88133.52133.86T:isapxv20
365.86369.81372.92aes256gcmv1
3501.153506.343511.01T:elephant160v2
3713.613717.413730.04T:elephant176v2
Cycles/byte for 0+long decrypt
25%50%75%aead
4.40?5.19?5.42?T:aes256gcmv1
6.746.766.76ascon128av12
10.2510.2510.26ascon80pqv12
10.3810.3810.38ascon128v12
11.8311.8711.90T:xoodyakround3
12.62?13.00?14.15?T:aes128gcmv1
13.9313.9713.98ascon128abi32v12
20.4920.5020.88ascon128bi32v12
22.2322.2622.50T:isapa128v20
24.0724.0824.17T:schwaemm256128v2
25.8425.8825.91T:isapa128av20
31.6231.6831.83T:schwaemm192192v2
32.1232.1932.30T:schwaemm128128v2
35.2535.2535.61T:tinyjambu256v2
35.6335.6335.72T:schwaemm256256v2
35.6935.7235.83T:giftcofb128v1
36.6836.6836.85T:tinyjambu128v2
37.2537.2537.42T:tinyjambu192v2
48.7248.8049.03T:romulusn
56.3156.4056.89romulusm
55.4756.5456.65romulusn
63.4363.6169.43T:isapk128av20
78.4182.1684.71T:isapk128v20
96.1196.45100.50T:elephant200v2
112.84113.11117.83T!!!romulust
126.86133.27134.88T:isapxv20
366.35370.27372.04aes256gcmv1
3499.643504.873506.66T:elephant160v2
3714.633718.303726.41T:elephant176v2
Cycles/byte for 0+long forgery
25%50%75%aead
2.08?5.63?6.89?T:aes256gcmv1
6.766.766.76ascon128av12
10.2610.2610.26ascon80pqv12
10.3810.3810.38ascon128v12
11.8511.8711.96T:xoodyakround3
12.4112.7413.03T:aes128gcmv1
13.9513.9814.02ascon128abi32v12
20.5120.5120.51ascon128bi32v12
22.0322.2522.47T:isapa128v20
24.0724.2724.27T:schwaemm256128v2
25.8325.8725.90T:isapa128av20
31.6731.6931.78T:schwaemm192192v2
32.1032.1932.19T:schwaemm128128v2
35.2535.2535.29T:tinyjambu256v2
35.6335.6335.77T:schwaemm256256v2
35.7235.7835.85T:giftcofb128v1
36.6736.6836.82T:tinyjambu128v2
37.2637.2637.30T:tinyjambu192v2
48.7648.8048.96T:romulusn
55.4455.5056.67romulusn
56.3456.5356.60romulusm
62.97?63.69?69.97?T:isapk128av20
73.55?83.90?87.67?T:isapk128v20
95.8796.3099.58T:elephant200v2
112.79112.88117.40T!!!romulust
127.62133.48134.11T:isapxv20
365.75370.21373.30aes256gcmv1
3500.243505.453514.94T:elephant160v2
3714.723717.663725.60T:elephant176v2
Cycles/byte for 1536+1536 encrypt
25%50%75%aead
7.077.077.09ascon128av12
10.4610.4610.47ascon128v12
10.5910.5910.59ascon80pqv12
14.5214.5214.55ascon128abi32v12
17.7017.7017.82T:xoodyakround3
21.2121.2121.31ascon128bi32v12
25.0025.0125.21T:schwaemm256128v2
25.6625.7427.54T:aes256gcmv1
32.5532.5932.77T:schwaemm128128v2
32.6632.7032.95T:schwaemm192192v2
33.1033.1934.85T:aes128gcmv1
35.3435.3535.48T:isapa128av20
36.2436.2736.69T:giftcofb128v1
36.7436.7536.89T:schwaemm256256v2
46.1846.2146.33T:tinyjambu128v2
48.3448.4051.69T:isapa128v20
50.6250.6452.76T:tinyjambu192v2
53.1353.1555.51T:tinyjambu256v2
57.3757.4359.62T:romulusn
85.4485.7687.89romulusn
93.4494.2497.36T:isapk128av20
113.72115.46116.04romulusm
148.69149.88150.30T:elephant200v2
185.50185.92186.19T:isapk128v20
230.12230.61230.95T!!!romulust
289.58290.47292.07T:isapxv20
5318.835323.025325.30T:elephant160v2
5665.005667.325670.05T:elephant176v2
12036.2912041.2412053.13aes256gcmv1
Cycles/byte for 1536+1536 decrypt
25%50%75%aead
7.017.017.03ascon128av12
10.4010.4010.40ascon80pqv12
10.4610.4610.46ascon128v12
14.5114.5314.53ascon128abi32v12
17.2917.3117.33T:xoodyakround3
20.7920.7920.96ascon128bi32v12
24.8524.8625.07T:schwaemm256128v2
28.8929.0231.10T:aes256gcmv1
32.5432.5532.93T:schwaemm192192v2
32.5732.5732.72T:schwaemm128128v2
33.2633.4034.73T:aes128gcmv1
35.3735.3935.62T:isapa128av20
36.1036.1236.28T:giftcofb128v1
36.7436.7637.16T:schwaemm256256v2
46.1846.2348.55T:tinyjambu128v2
48.3648.4451.43T:isapa128v20
50.6550.6853.64T:tinyjambu192v2
53.1353.1555.46T:tinyjambu256v2
57.1657.2459.19T:romulusn
85.7285.8188.29romulusn
93.5093.6797.38T:isapk128av20
113.82115.52116.41romulusm
147.81149.89150.46T:elephant200v2
185.62185.74185.96T:isapk128v20
229.67230.02231.01T!!!romulust
289.61290.91292.45T:isapxv20
5318.905320.685325.35T:elephant160v2
5664.235667.255669.32T:elephant176v2
12035.5712037.9212050.89aes256gcmv1
Cycles/byte for 1536+1536 forgery
25%50%75%aead
7.017.017.01ascon128av12
10.4010.4010.40ascon80pqv12
10.4610.4610.48ascon128v12
14.5314.5314.57ascon128abi32v12
17.3217.3317.33T:xoodyakround3
20.7920.7920.79ascon128bi32v12
24.8524.8524.98T:schwaemm256128v2
27.4827.4827.56T:isapa128av20
29.9629.9630.47T:isapa128v20
32.5332.5333.12T:schwaemm192192v2
32.5732.5832.66T:schwaemm128128v2
33.1533.4935.35T:aes128gcmv1
36.1036.2136.34T:giftcofb128v1
36.7336.7436.88T:schwaemm256256v2
42.1342.8146.52T:aes256gcmv1
46.1846.2549.29T:tinyjambu128v2
50.6250.6752.70T:tinyjambu192v2
53.1353.1555.10T:tinyjambu256v2
57.1557.2059.33T:romulusn
72.6672.7776.15T:isapk128av20
85.6085.7887.79romulusn
113.85115.96116.48romulusm
116.01118.40118.85T!!!romulust
121.42125.23125.53T:isapk128v20
147.79149.84151.06T:elephant200v2
188.33188.45188.90T:isapxv20
609.39609.65611.08aes256gcmv1
5318.425320.845324.19T:elephant160v2
5664.425665.055670.40T:elephant176v2
Cycles/byte for 64+64 encrypt
25%50%75%aead
10.6310.7511.19ascon128av12
13.6313.6313.94ascon128v12
13.7713.8014.07ascon80pqv12
22.0522.1622.73ascon128abi32v12
26.8326.8827.32T:xoodyakround3
28.6028.6028.98ascon128bi32v12
40.9540.9641.22T:schwaemm256128v2
43.1843.2543.45T:schwaemm128128v2
44.1944.3244.86T:giftcofb128v1
52.5752.5752.80T:schwaemm192192v2
53.8453.9254.08T:tinyjambu128v2
57.4357.4857.56T:schwaemm256256v2
58.9959.1259.46T:tinyjambu192v2
61.7961.8262.13T:tinyjambu256v2
73.7073.9574.66T:romulusn
94.1594.6996.10T:aes128gcmv1
99.2299.2499.74romulusn
101.99102.12102.88T:isapa128av20
128.81129.03130.05romulusm
192.12193.66197.07T:aes256gcmv1
206.98207.34208.72T:elephant200v2
295.87296.21296.86T!!!romulust
396.46396.64405.16T:isapa128v20
402.95403.14407.20T:isapk128av20
1987.722006.242094.08T:isapk128v20
2773.572821.982841.23T:isapxv20
7050.527076.187119.30T:elephant176v2
7108.987140.577157.43T:elephant160v2
17559.8817567.0517582.57aes256gcmv1
Cycles/byte for 64+64 decrypt
25%50%75%aead
10.6010.7211.20ascon128av12
13.6113.6113.88ascon128v12
13.6513.6513.86ascon80pqv12
22.4122.8223.49ascon128abi32v12
26.3626.4126.69T:xoodyakround3
28.5528.5529.08ascon128bi32v12
41.0141.0441.09T:schwaemm256128v2
43.3743.3743.49T:schwaemm128128v2
44.3144.4844.69T:giftcofb128v1
52.9453.0353.21T:schwaemm192192v2
53.9953.9954.02T:tinyjambu128v2
57.6657.6857.80T:schwaemm256256v2
59.0959.1659.31T:tinyjambu192v2
61.8761.9262.19T:tinyjambu256v2
73.5573.7175.20T:romulusn
93.0793.3294.84T:aes128gcmv1
99.3499.7399.84romulusn
102.53102.54102.99T:isapa128av20
129.88130.07130.59romulusm
206.96207.28208.58T:elephant200v2
242.81243.66258.75T:aes256gcmv1
296.39297.12298.05T!!!romulust
396.88396.88397.38T:isapa128v20
403.05403.21405.24T:isapk128av20
1988.881991.192094.72T:isapk128v20
2773.032819.232834.60T:isapxv20
7039.827081.587089.67T:elephant176v2
7111.327145.207157.69T:elephant160v2
17562.8817573.7317580.48aes256gcmv1
Cycles/byte for 64+64 forgery
25%50%75%aead
10.6210.6210.62ascon128av12
13.6213.6213.62ascon128v12
13.6513.6513.66ascon80pqv12
22.3022.3022.37ascon128abi32v12
26.5226.5526.79T:xoodyakround3
28.5528.5528.55ascon128bi32v12
40.9940.9941.08T:schwaemm256128v2
43.3743.3743.37T:schwaemm128128v2
44.3144.3144.32T:giftcofb128v1
52.9452.9553.26T:schwaemm192192v2
53.9553.9654.18T:tinyjambu128v2
57.6257.6857.70T:schwaemm256256v2
59.0959.0959.09T:tinyjambu192v2
61.8761.8761.88T:tinyjambu256v2
64.2664.4064.79T:isapa128av20
73.3473.4973.96T:romulusn
93.0493.7194.42T:aes128gcmv1
99.3499.7399.73romulusn
129.88130.27130.35romulusm
184.66184.84185.19T!!!romulust
207.03207.03207.42T:isapa128v20
206.87207.10207.34T:elephant200v2
277.31277.36278.20T:isapk128av20
561.66570.02621.48T:aes256gcmv1
1089.381091.011094.66T:isapk128v20
1449.651450.031508.68T:isapxv20
6113.126129.996178.01aes256gcmv1
7040.657080.477105.64T:elephant176v2
7106.147149.707159.08T:elephant160v2