VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: amd64; Goldmont Plus (706a8); 2019 Intel Celeron N4020; 2 x 1100MHz; gemini, supercop-20250307

[Page version: 20250425 10:21:43]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 2.13 2.33 2.34 T:aes128gcmv1 2.32 2.33 2.34 aes256gcmv1 10.45 10.47 10.48 ascon128av12 15.40 15.41 15.41 ascon80pqv12 16.00 16.00 16.00 ascon128v12 23.44 23.44 23.45 ascon128abi32v12 23.62 23.98 24.13 T:xoodyakround3 27.86 27.90 28.05 T:schwaemm256128v2 34.43 34.45 34.46 ascon128bi32v12 34.44 34.68 37.65 T:schwaemm256256v2 36.30 36.53 39.69 T:schwaemm128128v2 37.16 37.19 37.21 T:schwaemm192192v2 39.60 39.66 39.95 T:grain128aeadv2 45.52 45.84 49.71 romulusn 47.40 47.48 47.89 T:giftcofb128v1 62.57 62.73 62.85 T:isapa128av20 69.15 69.17 69.18 T:isapa128v20 78.02 78.06 78.12 romulusm 83.64 83.73 83.76 T:tinyjambu128v2 97.20 97.21 97.22 T:tinyjambu192v2 109.35 109.39 109.43 T:tinyjambu256v2 112.89 113.03 113.11 T:isapk128av20 144.63 144.65 144.74 T!!!romulust 149.59 150.13 152.05 T:isapk128v20 220.99 221.55 226.11 T:isapxv20 239.93 243.18 243.52 T:elephant200v2 11095.39 11096.58 11100.62 T:elephant176v2 12329.29 12330.01 12331.04 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 2.35 2.36 2.37 aes256gcmv1 2.19 2.41 2.43 T:aes128gcmv1 10.05 10.06 10.07 ascon128av12 14.90 14.91 14.91 ascon80pqv12 15.43 15.44 15.45 ascon128v12 23.24 23.24 23.25 ascon128abi32v12 22.96 23.33 23.47 T:xoodyakround3 27.81 27.83 28.09 T:schwaemm256128v2 33.96 34.21 36.96 T:schwaemm256256v2 34.49 34.51 34.51 ascon128bi32v12 36.31 36.50 39.77 T:schwaemm128128v2 37.04 37.06 37.07 T:schwaemm192192v2 41.90 41.91 41.92 T:grain128aeadv2 45.02 45.29 49.13 romulusn 47.22 47.49 47.60 T:giftcofb128v1 62.19 62.71 62.78 T:isapa128av20 69.15 69.19 69.20 T:isapa128v20 77.53 77.58 77.78 romulusm 82.93 82.98 83.00 T:tinyjambu128v2 97.27 97.27 97.28 T:tinyjambu192v2 108.69 108.75 108.75 T:tinyjambu256v2 113.11 113.37 113.50 T:isapk128av20 144.67 144.70 144.72 T!!!romulust 148.88 150.16 151.33 T:isapk128v20 221.01 221.55 225.67 T:isapxv20 239.92 243.22 243.52 T:elephant200v2 11092.54 11095.22 11100.24 T:elephant176v2 12324.75 12329.98 12330.47 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 2.18? 2.20? 2.43? T:aes128gcmv1 2.35 2.36 2.36 aes256gcmv1 10.06 10.06 10.07 ascon128av12 14.90 14.91 14.91 ascon80pqv12 15.43 15.44 15.45 ascon128v12 23.24 23.24 23.25 ascon128abi32v12 23.05 23.41 23.56 T:xoodyakround3 27.81 27.83 28.09 T:schwaemm256128v2 33.94 34.20 37.44 T:schwaemm256256v2 34.49 34.51 34.85 T:isapa128v20 34.50 34.51 34.51 ascon128bi32v12 36.29 36.49 39.72 T:schwaemm128128v2 37.06 37.07 37.07 T:schwaemm192192v2 40.77 41.07 41.10 T:isapa128av20 41.90 41.91 42.15 T:grain128aeadv2 45.67 45.89 49.27 romulusn 47.44 47.45 47.59 T:giftcofb128v1 51.80 51.86 51.90 T!!!romulust 74.27 74.55 74.72 T:isapk128av20 77.50 77.60 77.86 romulusm 82.93 82.95 82.98 T:tinyjambu128v2 93.08 93.63 95.05 T:isapk128v20 97.27 97.27 97.29 T:tinyjambu192v2 108.69 108.75 108.81 T:tinyjambu256v2 129.99 131.97 132.80 T:isapxv20 242.07 243.21 247.09 T:elephant200v2 11092.56 11094.96 11100.29 T:elephant176v2 12329.13 12330.11 12330.67 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 1.77 1.79 1.81 aes256gcmv1 1.69? 1.81? 1.91? T:aes128gcmv1 10.22 10.24 10.25 ascon128av12 14.74 14.75 14.79 ascon80pqv12 15.24 15.24 15.25 ascon128v12 16.75 17.04 17.23 T:xoodyakround3 22.94 22.95 22.97 ascon128abi32v12 27.69 27.70 27.87 T:schwaemm256128v2 34.22 34.23 34.23 ascon128bi32v12 34.18 34.42 37.31 T:schwaemm256256v2 36.18 36.60 39.50 T:schwaemm128128v2 36.69 36.70 36.77 T:schwaemm192192v2 37.79 38.01 41.30 romulusn 39.31 39.37 39.61 T:grain128aeadv2 47.83 47.85 47.91 T:giftcofb128v1 51.61 51.62 51.62 T:isapa128v20 51.65 52.37 52.49 T:isapa128av20 54.61 54.84 54.85 romulusm 69.11 69.14 69.15 T:tinyjambu128v2 75.97 75.98 75.98 T:tinyjambu192v2 82.55 82.57 82.63 T:tinyjambu256v2 93.72 93.79 93.91 T:isapk128av20 97.80 97.82 98.40 T!!!romulust 121.31 121.54 122.45 T:isapk128v20 175.97 176.87 177.05 T:isapxv20 178.83 181.14 181.33 T:elephant200v2 8258.64 8260.34 8266.67 T:elephant176v2 9243.58 9244.76 9245.62 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 1.79 1.81 1.82 aes256gcmv1 1.70? 1.82? 1.92? T:aes128gcmv1 10.06 10.07 10.08 ascon128av12 14.76 14.77 14.77 ascon80pqv12 14.96 14.97 14.97 ascon128v12 16.61 16.70 16.79 T:xoodyakround3 23.13 23.15 23.16 ascon128abi32v12 27.66 27.67 27.88 T:schwaemm256128v2 33.78 33.79 33.79 ascon128bi32v12 33.94 34.18 37.41 T:schwaemm256256v2 36.38 36.60 39.22 T:schwaemm128128v2 36.69 36.70 36.70 T:schwaemm192192v2 37.49 37.72 40.57 romulusn 40.50 40.51 40.79 T:grain128aeadv2 47.72 47.73 47.73 T:giftcofb128v1 51.33 51.60 51.73 T:isapa128v20 51.91 52.66 53.01 T:isapa128av20 54.51 54.52 54.60 romulusm 67.76 67.87 68.13 T:tinyjambu128v2 76.15 76.15 76.15 T:tinyjambu192v2 82.35 82.35 82.35 T:tinyjambu256v2 93.77 93.91 94.09 T:isapk128av20 97.80 97.81 98.02 T!!!romulust 121.08 121.42 122.07 T:isapk128v20 175.98 176.72 177.04 T:isapxv20 178.93 181.13 181.17 T:elephant200v2 8258.62 8260.52 8266.22 T:elephant176v2 9243.34 9244.94 9247.16 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 1.81 1.81 1.82 aes256gcmv1 1.71 1.82 1.84 T:aes128gcmv1 10.07 10.07 10.08 ascon128av12 14.77 14.77 14.77 ascon80pqv12 14.97 14.97 14.98 ascon128v12 16.65 16.72 16.84 T:xoodyakround3 23.15 23.15 23.16 ascon128abi32v12 27.66 27.67 27.89 T:schwaemm256128v2 33.79 33.79 33.79 ascon128bi32v12 33.94 34.18 37.36 T:schwaemm256256v2 34.00 34.28 34.29 T:isapa128v20 36.35 36.60 39.48 T:schwaemm128128v2 36.69 36.70 36.70 T:schwaemm192192v2 37.63 37.78 40.88 romulusn 40.48 40.57 40.79 T:grain128aeadv2 41.13 42.17 42.19 T:isapa128av20 47.83 47.84 47.88 T:giftcofb128v1 51.37 51.56 51.82 T!!!romulust 54.49 54.62 54.64 romulusm 67.76 68.05 68.13 T:tinyjambu128v2 74.42 74.56 74.66 T:isapk128av20 76.15 76.15 76.16 T:tinyjambu192v2 82.35 82.35 82.35 T:tinyjambu256v2 92.80 93.04 93.60 T:isapk128v20 130.46 131.14 131.39 T:isapxv20 178.87 181.14 181.33 T:elephant200v2 8258.84 8260.51 8265.92 T:elephant176v2 9243.37 9244.99 9245.56 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 1.24 1.26 1.27 aes256gcmv1 1.26? 1.32? 1.52? T:aes128gcmv1 9.98 10.00 10.22 ascon128av12 9.89 10.11 10.35 T:xoodyakround3 14.50 14.52 14.53 ascon128v12 14.62 14.62 14.63 ascon80pqv12 22.45 22.46 22.47 ascon128abi32v12 27.50 27.54 27.69 T:schwaemm256128v2 29.76 30.22 32.61 romulusn 31.52 31.57 31.76 romulusm 33.74 33.75 33.76 ascon128bi32v12 33.85 33.88 33.89 T:isapa128v20 33.94 34.19 36.71 T:schwaemm256256v2 36.38 36.41 36.44 T:schwaemm192192v2 36.16 36.71 39.34 T:schwaemm128128v2 38.81 39.08 39.28 T:grain128aeadv2 41.22 41.22 41.24 T:isapa128av20 48.09 48.27 48.29 T:giftcofb128v1 52.19 52.22 52.23 T!!!romulust 53.38 54.20 54.29 T:tinyjambu128v2 54.77 54.78 54.78 T:tinyjambu192v2 55.74 55.74 55.76 T:tinyjambu256v2 74.45 74.52 74.68 T:isapk128av20 93.17 93.22 93.27 T:isapk128v20 117.14 118.11 119.83 T:elephant200v2 130.07 132.07 132.60 T:isapxv20 5535.81 5537.31 5537.64 T:elephant176v2 6157.50 6160.47 6160.67 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 1.22? 1.25? 1.46? T:aes128gcmv1 1.24 1.27 1.30 aes256gcmv1 10.05 10.06 10.07 ascon128av12 10.06 10.14 10.27 T:xoodyakround3 14.49 14.50 14.51 ascon128v12 14.62 14.63 14.63 ascon80pqv12 22.65 22.66 22.67 ascon128abi32v12 27.50 27.54 27.70 T:schwaemm256128v2 30.03 30.27 32.31 romulusn 31.53 31.66 31.82 romulusm 33.06 33.07 33.07 ascon128bi32v12 33.94 34.18 37.16 T:schwaemm256256v2 33.85 34.44 34.49 T:isapa128v20 36.41 36.42 36.42 T:schwaemm192192v2 36.51 36.72 39.41 T:schwaemm128128v2 39.09 39.15 39.48 T:grain128aeadv2 41.20 41.23 41.26 T:isapa128av20 48.08 48.14 48.28 T:giftcofb128v1 51.40 51.64 51.78 T!!!romulust 52.57 52.83 53.32 T:tinyjambu128v2 54.77 54.77 54.79 T:tinyjambu192v2 56.03 56.03 56.04 T:tinyjambu256v2 74.31 74.56 74.80 T:isapk128av20 93.00 93.22 93.59 T:isapk128v20 117.15 118.12 119.97 T:elephant200v2 130.52 132.08 132.98 T:isapxv20 5534.23 5537.51 5538.14 T:elephant176v2 6157.84 6160.50 6160.78 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 1.22? 1.23? 1.46? T:aes128gcmv1 1.27 1.28 1.28 aes256gcmv1 10.05 10.07 10.08 ascon128av12 10.06 10.19 10.27 T:xoodyakround3 14.49 14.50 14.51 ascon128v12 14.62 14.62 14.63 ascon80pqv12 22.66 22.66 22.66 ascon128abi32v12 27.50 27.53 27.68 T:schwaemm256128v2 30.00 30.23 32.36 romulusn 31.50 31.54 31.66 romulusm 33.06 33.07 33.07 ascon128bi32v12 33.95 34.19 37.15 T:schwaemm256256v2 33.86 34.44 34.45 T:isapa128v20 36.41 36.42 36.42 T:schwaemm192192v2 36.18 36.73 38.99 T:schwaemm128128v2 39.12 39.16 39.49 T:grain128aeadv2 41.21 41.22 41.25 T:isapa128av20 47.89 48.11 48.29 T:giftcofb128v1 51.38 51.63 51.78 T!!!romulust 52.57 52.61 53.32 T:tinyjambu128v2 54.77 54.77 54.77 T:tinyjambu192v2 56.03 56.03 56.04 T:tinyjambu256v2 74.32 74.60 74.64 T:isapk128av20 92.56 93.15 93.82 T:isapk128v20 117.02 118.11 119.81 T:elephant200v2 130.52 132.07 133.00 T:isapxv20 5535.01 5537.88 5538.13 T:elephant176v2 6157.55 6160.56 6160.83 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 1.97 1.98 2.00 aes256gcmv1 1.86 1.99 2.01 T:aes128gcmv1 10.47 10.48 10.58 ascon128av12 14.98 14.98 14.99 ascon80pqv12 15.47 15.47 15.47 ascon128v12 16.92 17.17 17.35 T:xoodyakround3 23.46 23.46 23.47 ascon128abi32v12 28.49 28.50 28.65 T:schwaemm256128v2 34.73 34.73 34.73 ascon128bi32v12 35.30 35.30 38.11 T:schwaemm256256v2 36.93 37.09 39.67 T:schwaemm128128v2 37.51 37.52 37.53 T:schwaemm192192v2 38.38 38.44 41.17 romulusn 39.74 39.84 40.08 T:grain128aeadv2 48.33 48.34 48.41 T:giftcofb128v1 55.07 55.18 55.23 romulusm 57.17 57.23 57.23 T:isapa128av20 69.64 69.98 69.98 T:tinyjambu128v2 75.50 75.50 75.63 T:isapa128v20 76.56 76.57 76.57 T:tinyjambu192v2 83.20 83.20 83.23 T:tinyjambu256v2 99.54 99.55 100.11 T!!!romulust 108.58 108.68 108.76 T:isapk128av20 182.94 184.95 184.98 T:elephant200v2 215.79 216.00 216.42 T:isapk128v20 281.25 281.26 281.62 T:isapxv20 8325.23 8326.62 8328.75 T:elephant176v2 9345.61 9349.26 9349.42 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 1.98 1.99 2.01 aes256gcmv1 1.87 2.00 2.02 T:aes128gcmv1 10.31 10.31 10.31 ascon128av12 15.00 15.00 15.01 ascon80pqv12 15.20 15.20 15.20 ascon128v12 16.77 16.84 16.93 T:xoodyakround3 23.66 23.66 23.67 ascon128abi32v12 28.47 28.50 28.67 T:schwaemm256128v2 34.30 34.30 34.30 ascon128bi32v12 35.07 35.08 38.01 T:schwaemm256256v2 36.94 37.07 39.88 T:schwaemm128128v2 37.51 37.51 37.52 T:schwaemm192192v2 38.18 38.44 40.91 romulusn 41.02 41.02 41.26 T:grain128aeadv2 48.12 48.23 48.24 T:giftcofb128v1 55.05 55.07 55.09 romulusm 57.31 57.74 57.78 T:isapa128av20 68.32 68.38 68.64 T:tinyjambu128v2 75.24 75.24 75.25 T:isapa128v20 76.72 76.74 76.76 T:tinyjambu192v2 83.02 83.05 83.28 T:tinyjambu256v2 99.55 99.73 99.74 T!!!romulust 108.70 108.78 108.80 T:isapk128av20 183.01 184.94 184.98 T:elephant200v2 215.68 215.72 216.60 T:isapk128v20 281.26 281.53 283.64 T:isapxv20 8325.42 8326.31 8330.51 T:elephant176v2 9345.60 9349.31 9349.68 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 1.87 1.99 2.00 T:aes128gcmv1 1.98 1.99 2.00 aes256gcmv1 10.31 10.31 10.31 ascon128av12 15.00 15.00 15.01 ascon80pqv12 15.20 15.21 15.21 ascon128v12 16.83 16.89 16.99 T:xoodyakround3 23.66 23.66 23.66 ascon128abi32v12 28.46 28.46 28.66 T:schwaemm256128v2 34.30 34.30 34.30 ascon128bi32v12 35.06 35.07 37.98 T:schwaemm256256v2 36.93 37.08 39.43 T:schwaemm128128v2 37.51 37.51 37.51 T:schwaemm192192v2 38.18 38.44 40.85 romulusn 41.02 41.03 41.26 T:grain128aeadv2 44.74 44.75 44.76 T:isapa128av20 46.33 46.59 46.59 T:isapa128v20 48.24 48.33 48.33 T:giftcofb128v1 53.02 53.03 53.20 T!!!romulust 55.03 55.03 55.04 romulusm 68.31 68.64 68.69 T:tinyjambu128v2 76.72 76.73 76.74 T:tinyjambu192v2 82.98 83.00 83.02 T:isapk128av20 83.02 83.02 83.28 T:tinyjambu256v2 141.84 141.88 142.22 T:isapk128v20 184.38 184.40 185.94 T:isapxv20 182.89 184.95 184.96 T:elephant200v2 8325.89 8327.87 8331.47 T:elephant176v2 9346.34 9348.96 9349.54 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 8.09? 8.22? 9.04? T:aes128gcmv1 9.19 9.27 9.57 aes256gcmv1 15.91 16.00 16.30 ascon128av12 20.23 20.43 20.56 ascon80pqv12 20.50 20.67 20.89 ascon128v12 24.28 24.44 24.68 T:xoodyakround3 35.00 35.13 35.41 ascon128abi32v12 46.24 46.24 46.41 ascon128bi32v12 46.55 46.65 46.70 T:schwaemm256128v2 47.21 47.31 50.48 romulusn 47.35 47.54 51.15 T:schwaemm128128v2 50.63 51.02 51.19 T:grain128aeadv2 55.58 55.71 59.14 T:schwaemm256256v2 59.35 59.48 59.80 T:giftcofb128v1 60.50 60.54 60.81 T:schwaemm192192v2 63.66 64.09 64.28 romulusm 81.12 81.38 81.41 T:tinyjambu128v2 89.82 89.82 90.04 T:tinyjambu192v2 97.46 97.92 97.92 T:tinyjambu256v2 138.26 138.83 139.55 T!!!romulust 166.81 166.83 167.07 T:isapa128av20 258.68 261.72 262.12 T:elephant200v2 428.91 429.03 429.19 T:isapk128av20 624.55 624.55 624.71 T:isapa128v20 2360.41 2364.03 2370.09 T:isapk128v20 2652.08 2658.03 2677.49 T:isapxv20 10437.22 10439.78 10454.67 T:elephant176v2 12517.30 12518.39 12523.71 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 7.87 8.08 8.62 T:aes128gcmv1 8.98 9.09 9.66 aes256gcmv1 15.83 15.90 16.05 ascon128av12 20.31 20.50 20.55 ascon80pqv12 20.30 20.52 20.78 ascon128v12 23.86 24.08 24.21 T:xoodyakround3 35.29 35.45 35.98 ascon128abi32v12 45.97 45.99 46.32 ascon128bi32v12 46.66 46.78 46.88 T:schwaemm256128v2 47.35 47.43 50.71 T:schwaemm128128v2 47.27 47.45 49.94 romulusn 51.39 51.61 51.88 T:grain128aeadv2 55.52 55.65 58.89 T:schwaemm256256v2 59.70 59.77 59.77 T:giftcofb128v1 60.44 60.46 60.85 T:schwaemm192192v2 66.05 66.41 66.49 romulusm 80.50 80.64 80.91 T:tinyjambu128v2 90.10 90.10 90.16 T:tinyjambu192v2 97.95 98.12 98.12 T:tinyjambu256v2 137.94 138.99 139.56 T!!!romulust 167.02 167.20 167.49 T:isapa128av20 258.35 261.42 261.77 T:elephant200v2 429.70 429.98 432.80 T:isapk128av20 616.73 616.85 624.98 T:isapa128v20 2358.70 2360.73 2368.03 T:isapk128v20 2652.36 2652.50 2677.91 T:isapxv20 10436.77 10449.22 10472.02 T:elephant176v2 12516.51 12518.75 12522.17 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 7.77? 7.94? 8.66? T:aes128gcmv1 8.98 8.98 9.41 aes256gcmv1 15.71 15.82 15.84 ascon128av12 20.15 20.20 20.27 ascon128v12 20.09 20.27 20.33 ascon80pqv12 23.95 24.21 24.22 T:xoodyakround3 35.29 35.33 35.45 ascon128abi32v12 45.95 45.98 46.02 ascon128bi32v12 46.62 46.66 46.79 T:schwaemm256128v2 47.23 47.28 50.43 romulusn 47.17 47.37 50.83 T:schwaemm128128v2 51.16 51.26 51.41 T:grain128aeadv2 55.52 55.52 58.63 T:schwaemm256256v2 59.44 59.67 59.93 T:giftcofb128v1 60.43 60.44 60.46 T:schwaemm192192v2 66.03 66.18 66.40 romulusm 80.40 80.49 80.50 T:tinyjambu128v2 90.04 90.05 90.31 T!!!romulust 90.09 90.09 90.09 T:tinyjambu192v2 97.96 98.12 98.12 T:tinyjambu256v2 104.41 104.44 104.73 T:isapa128av20 258.16 261.43 261.77 T:elephant200v2 260.04 262.30 263.16 T:isapk128av20 329.46 329.46 329.66 T:isapa128v20 1243.82 1244.20 1244.63 T:isapk128v20 1390.23 1390.30 1403.56 T:isapxv20 10431.90 10454.07 10462.71 T:elephant176v2 12516.80 12517.77 12522.77 T:elephant160v2