VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: amd64; Zen 3 (a20f10); 2020 AMD Ryzen 5 5600X; 6 x 3700MHz; unstable; spawn, supercop-20231215

[Page version: 20240726 23:46:23]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Implementation notes

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 1.41 1.41 1.43 T:aes128gcmv1 1.54 1.54 1.54 aes256gcmv1 5.18 5.18 5.26 ascon128av12 7.27 7.28 7.32 ascon80pqv12 7.48 7.50 7.53 ascon128v12 10.33 10.44 10.54 ascon128abi32v12 15.09 15.19 15.26 ascon128bi32v12 19.12 19.16 19.27 T:schwaemm256128v2 19.62 19.83 19.91 T:grain128aeadv2 24.30 24.44 24.59 T:schwaemm256256v2 26.17 26.27 26.38 T:schwaemm192192v2 28.08 28.10 28.17 T:isapa128v20 29.10 29.50 29.54 T:isapa128av20 30.26 30.41 30.74 T:schwaemm128128v2 30.93 31.03 31.10 romulusn 32.32 32.68 32.90 T:giftcofb128v1 40.95 41.03 41.36 T:xoodyakround3 46.65 47.29 47.77 T:isapk128av20 48.27 48.37 48.50 T:tinyjambu128v2 49.18 49.41 49.47 romulusm 55.44 55.46 55.48 T:tinyjambu192v2 56.23 56.33 56.33 T:tinyjambu256v2 66.20 69.16 69.55 T:isapk128v20 102.39 102.91 103.02 T:elephant200v2 104.47 104.56 104.70 romulust 272.86 277.81 280.91 T:isapxv20 5800.04 5844.77 5879.92 T:elephant176v2 6987.26 7036.86 7056.79 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 1.41 1.43 1.43 T:aes128gcmv1 1.52 1.56 1.58 aes256gcmv1 4.88 4.88 4.95 ascon128av12 7.27 7.27 7.32 ascon80pqv12 7.27 7.30 7.32 ascon128v12 10.44 10.58 10.64 ascon128abi32v12 15.40 15.49 15.57 ascon128bi32v12 19.44 19.54 19.58 T:schwaemm256128v2 20.16 20.52 20.97 T:grain128aeadv2 24.42 24.55 24.65 T:schwaemm256256v2 26.77 26.81 26.88 T:schwaemm192192v2 28.08 28.08 28.15 T:isapa128v20 29.12 29.54 29.60 T:isapa128av20 30.39 30.54 30.78 T:schwaemm128128v2 31.14 31.22 31.24 romulusn 32.05 32.59 32.63 T:giftcofb128v1 40.55 40.76 41.05 T:xoodyakround3 46.15 46.96 48.00 T:isapk128av20 48.35 48.41 48.49 T:tinyjambu128v2 49.35 49.56 49.64 romulusm 55.60 55.62 55.65 T:tinyjambu192v2 56.46 56.54 56.58 T:tinyjambu256v2 66.27 68.70 69.45 T:isapk128v20 102.58 102.94 103.04 T:elephant200v2 104.54 104.72 105.32 romulust 271.64 272.97 282.22 T:isapxv20 5800.23 5842.74 5847.97 T:elephant176v2 6965.02 7033.82 7049.43 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 1.39 1.43 1.43 T:aes128gcmv1 1.52 1.56 1.56 aes256gcmv1 4.88 4.89 4.95 ascon128av12 7.27 7.28 7.32 ascon128v12 7.27 7.28 7.32 ascon80pqv12 10.44 10.56 10.62 ascon128abi32v12 13.89 13.95 13.99 T:isapa128v20 15.40 15.49 15.57 ascon128bi32v12 19.48 19.54 19.60 T:schwaemm256128v2 19.33 19.58 19.64 T:isapa128av20 20.25 20.54 20.99 T:grain128aeadv2 24.44 24.53 24.63 T:schwaemm256256v2 26.77 26.79 26.86 T:schwaemm192192v2 29.68 30.08 30.24 T:isapk128av20 30.39 30.45 30.76 T:schwaemm128128v2 31.14 31.20 31.24 romulusn 32.01 32.59 32.63 T:giftcofb128v1 35.11 35.19 35.34 romulust 40.55 40.76 41.03 T:xoodyakround3 41.41 42.76 44.27 T:isapk128v20 48.33 48.37 48.49 T:tinyjambu128v2 49.35 49.56 49.70 romulusm 55.60 55.62 55.63 T:tinyjambu192v2 56.44 56.52 56.91 T:tinyjambu256v2 102.33 102.52 102.98 T:elephant200v2 163.47 164.90 169.35 T:isapxv20 5807.32 5844.55 5870.42 T:elephant176v2 6985.81 7032.18 7057.04 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.89 0.91 0.91 T:aes128gcmv1 0.94 0.94 0.96 aes256gcmv1 5.02 5.04 5.07 ascon128av12 7.33 7.34 7.37 ascon128v12 7.35 7.40 7.41 ascon80pqv12 10.23 10.27 10.40 ascon128abi32v12 15.25 15.34 15.51 ascon128bi32v12 18.97 19.00 19.05 T:schwaemm256128v2 19.71 19.84 20.06 T:grain128aeadv2 21.14 21.29 21.31 T:isapa128v20 24.14 24.19 24.29 T:schwaemm256256v2 24.19 24.37 24.54 T:isapa128av20 24.69 24.72 24.83 romulusn 26.08 26.14 26.27 T:schwaemm192192v2 30.00 30.10 30.16 T:schwaemm128128v2 31.65 31.70 31.74 T:xoodyakround3 31.97 32.36 32.55 T:giftcofb128v1 33.57 33.77 34.00 romulusm 38.94 39.09 39.19 T:tinyjambu128v2 40.07 40.32 41.10 T:isapk128av20 42.27 42.40 42.65 T:tinyjambu256v2 42.34 42.73 42.98 T:tinyjambu192v2 53.35 55.45 55.87 T:isapk128v20 69.45 69.92 70.23 romulust 76.79 77.63 78.09 T:elephant200v2 218.16? 220.24? 264.22? T:isapxv20 4281.82 4353.62 4363.88 T:elephant176v2 5238.01 5289.19 5301.39 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.90 0.90 0.91 T:aes128gcmv1 0.94 0.94 0.95 aes256gcmv1 4.89 4.92 4.94 ascon128av12 7.22 7.24 7.27 ascon128v12 7.34 7.36 7.38 ascon80pqv12 10.34 10.37 10.49 ascon128abi32v12 15.10 15.19 15.37 ascon128bi32v12 19.13 19.16 19.18 T:schwaemm256128v2 19.85 20.21 20.27 T:grain128aeadv2 21.03 21.21 21.31 T:isapa128v20 24.17 24.22 24.32 T:schwaemm256256v2 24.18 24.35 24.55 T:isapa128av20 24.82 24.87 24.98 romulusn 26.34 26.39 26.43 T:schwaemm192192v2 30.09 30.17 30.32 T:schwaemm128128v2 31.54 31.58 31.60 T:xoodyakround3 31.92 32.49 32.51 T:giftcofb128v1 33.68 33.85 33.90 romulusm 39.12 39.20 39.35 T:tinyjambu128v2 39.89 40.71 40.82 T:isapk128av20 42.45 42.49 42.77 T:tinyjambu256v2 42.13 42.79 43.06 T:tinyjambu192v2 53.42 55.51 56.24 T:isapk128v20 69.77 69.86 70.25 romulust 76.75 77.65 78.12 T:elephant200v2 216.64? 220.43? 263.13? T:isapxv20 4284.40 4339.27 4359.00 T:elephant176v2 5243.49 5284.30 5303.31 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.90 0.90 0.91 T:aes128gcmv1 0.94 0.94 0.96 aes256gcmv1 4.88 4.91 4.94 ascon128av12 7.22 7.24 7.27 ascon128v12 7.34 7.38 7.38 ascon80pqv12 10.32 10.39 10.44 ascon128abi32v12 13.94 14.03 14.14 T:isapa128v20 15.10 15.19 15.37 ascon128bi32v12 19.13 19.16 19.20 T:schwaemm256128v2 19.30 19.43 19.57 T:isapa128av20 20.15 20.19 20.26 T:grain128aeadv2 24.19 24.26 24.32 T:schwaemm256256v2 24.83 24.88 24.98 romulusn 26.38 26.41 26.45 T:schwaemm192192v2 30.14 30.20 30.30 T:schwaemm128128v2 31.40 31.52 31.61 T:xoodyakround3 31.48 31.69 32.13 T:isapk128av20 31.91 32.49 32.51 T:giftcofb128v1 33.68 33.83 33.88 romulusm 35.09 35.13 35.30 romulust 39.07 39.17 39.24 T:tinyjambu128v2 42.47 42.50 42.75 T:tinyjambu256v2 41.42 42.52 43.05 T:isapk128v20 42.77 42.80 42.94 T:tinyjambu192v2 76.76 77.24 78.18 T:elephant200v2 162.41? 163.67? 191.91? T:isapxv20 4284.93 4354.92 4364.72 T:elephant176v2 5242.46 5287.62 5315.70 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.37 0.37 0.37 aes256gcmv1 0.35? 0.39? 0.39? T:aes128gcmv1 4.86 4.89 4.93 ascon128av12 7.13 7.13 7.21 ascon128v12 7.38 7.40 7.48 ascon80pqv12 10.08 10.19 10.21 ascon128abi32v12 14.03 14.07 14.22 T:isapa128v20 15.38 15.49 15.67 ascon128bi32v12 18.46 18.46 18.52 romulusn 18.40 18.52 18.62 romulusm 18.77 18.85 18.90 T:schwaemm256128v2 19.43 19.48 19.62 T:isapa128av20 19.89 19.98 20.25 T:grain128aeadv2 21.93 22.03 22.12 T:xoodyakround3 24.05 24.15 24.49 T:schwaemm256256v2 25.96 26.02 26.03 T:schwaemm192192v2 28.48 28.62 28.64 T:tinyjambu256v2 29.62 29.83 29.95 T:schwaemm128128v2 30.10 30.47 30.49 T:tinyjambu128v2 30.33 30.49 30.52 T:tinyjambu192v2 31.82 32.38 32.45 T:giftcofb128v1 33.43 33.53 33.96 T:isapk128av20 35.11 35.15 35.30 romulust 42.18? 42.67? 108.82? T:isapk128v20 52.19 52.34 52.84 T:elephant200v2 163.36 166.83 172.69 T:isapxv20 2869.62 2890.82 2906.39 T:elephant176v2 3489.68 3519.47 3522.59 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.35 0.37 0.37 aes256gcmv1 0.37 0.39 0.39 T:aes128gcmv1 4.89 4.93 4.99 ascon128av12 7.13 7.13 7.21 ascon128v12 7.34 7.34 7.42 ascon80pqv12 10.18 10.31 10.31 ascon128abi32v12 13.97 14.03 14.07 T:isapa128v20 14.80 14.88 15.05 ascon128bi32v12 18.46 18.50 18.56 romulusn 18.42 18.54 18.63 romulusm 18.81 18.85 18.94 T:schwaemm256128v2 19.43 19.44 19.54 T:isapa128av20 20.08 20.16 20.37 T:grain128aeadv2 21.85 21.91 22.12 T:xoodyakround3 24.05 24.20 24.45 T:schwaemm256256v2 25.98 26.03 26.07 T:schwaemm192192v2 28.48 28.64 28.66 T:tinyjambu256v2 29.56 29.66 29.95 T:schwaemm128128v2 30.10 30.45 30.47 T:tinyjambu128v2 30.33 30.49 30.51 T:tinyjambu192v2 31.95 32.36 32.41 T:giftcofb128v1 33.76 33.88 34.24 T:isapk128av20 35.09 35.21 35.32 romulust 41.14? 42.61? 109.55? T:isapk128v20 51.95 52.13 52.47 T:elephant200v2 166.89 168.95 170.60 T:isapxv20 2863.72 2887.39 2906.62 T:elephant176v2 3490.10 3521.32 3529.63 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.35 0.37 0.37 aes256gcmv1 0.35? 0.39? 0.39? T:aes128gcmv1 4.91 4.95 4.99 ascon128av12 7.13 7.13 7.21 ascon128v12 7.34 7.34 7.42 ascon80pqv12 10.18 10.31 10.31 ascon128abi32v12 13.95 14.03 14.14 T:isapa128v20 14.80 14.88 15.05 ascon128bi32v12 18.48 18.50 18.56 romulusn 18.46 18.54 18.60 romulusm 18.77 18.81 18.92 T:schwaemm256128v2 19.37 19.43 19.52 T:isapa128av20 20.12 20.16 20.25 T:grain128aeadv2 21.89 21.95 22.14 T:xoodyakround3 24.05 24.17 24.49 T:schwaemm256256v2 25.92 26.00 26.03 T:schwaemm192192v2 28.46 28.64 28.66 T:tinyjambu256v2 29.60 29.68 29.95 T:schwaemm128128v2 30.08 30.45 30.51 T:tinyjambu128v2 30.33 30.49 30.51 T:tinyjambu192v2 32.01 32.38 32.41 T:giftcofb128v1 33.17 33.97 34.17 T:isapk128av20 35.07 35.19 35.30 romulust 41.66? 42.65? 109.48? T:isapk128v20 51.95 52.17 52.42 T:elephant200v2 166.08 168.70 171.11 T:isapxv20 2874.77 2890.34 2896.68 T:elephant176v2 3490.28 3521.59 3525.10 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 0.98 0.99 0.99 T:aes128gcmv1 1.05 1.05 1.06 aes256gcmv1 5.14 5.17 5.19 ascon128av12 7.42 7.46 7.46 ascon128v12 7.46 7.47 7.47 ascon80pqv12 10.50 10.53 10.62 ascon128abi32v12 15.55 15.62 15.69 ascon128bi32v12 19.54 19.57 19.68 T:schwaemm256128v2 20.31 20.38 20.40 T:grain128aeadv2 24.67 24.79 25.23 T:schwaemm256256v2 24.88 24.93 24.96 romulusn 26.65 26.67 26.71 T:schwaemm192192v2 27.85 27.86 28.00 T:isapa128av20 30.35 30.41 30.51 T:schwaemm128128v2 30.76 30.79 30.94 T:isapa128v20 32.46 32.81 32.82 T:giftcofb128v1 33.89 34.04 34.19 romulusm 32.16? 37.00? 37.33? T:xoodyakround3 39.34 39.48 39.53 T:tinyjambu128v2 42.71 42.72 42.73 T:tinyjambu256v2 43.07? 43.31? 60.52? T:tinyjambu192v2 45.70 45.88 46.73 T:isapk128av20 70.89 70.96 71.24 romulust 78.47 79.81 80.15 T:elephant200v2 90.78 92.79 93.19 T:isapk128v20 376.84 377.21 378.90 T:isapxv20 4350.47 4417.10 4420.77 T:elephant176v2 5298.71 5335.74 5342.32 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 0.99 0.99 1.00 T:aes128gcmv1 1.05 1.06 1.06 aes256gcmv1 5.01 5.03 5.06 ascon128av12 7.32 7.35 7.35 ascon128v12 7.43 7.43 7.44 ascon80pqv12 10.62 10.70 10.74 ascon128abi32v12 15.43 15.48 15.56 ascon128bi32v12 19.79 19.81 19.82 T:schwaemm256128v2 20.46 20.68 20.82 T:grain128aeadv2 24.76 24.82 25.22 T:schwaemm256256v2 25.03 25.08 25.10 romulusn 26.91 26.93 26.94 T:schwaemm192192v2 27.83 27.85 27.99 T:isapa128av20 30.41 30.51 30.59 T:schwaemm128128v2 30.77 30.77 30.94 T:isapa128v20 32.24 32.77 32.78 T:giftcofb128v1 33.95 34.00 34.33 romulusm 32.11? 36.67? 37.36? T:xoodyakround3 39.52 39.64 39.70 T:tinyjambu128v2 42.60 43.07 43.31 T:tinyjambu256v2 43.38? 43.40? 61.09? T:tinyjambu192v2 45.46 45.73 46.02 T:isapk128av20 70.93 70.96 71.30 romulust 78.52 79.75 79.85 T:elephant200v2 90.75 92.40 93.19 T:isapk128v20 373.08 377.74 381.30 T:isapxv20 4351.79 4414.36 4421.54 T:elephant176v2 5300.82 5335.27 5340.88 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 0.99 0.99 0.99 T:aes128gcmv1 1.05 1.05 1.06 aes256gcmv1 5.01 5.03 5.06 ascon128av12 7.32 7.35 7.36 ascon128v12 7.43 7.43 7.44 ascon80pqv12 10.57 10.68 10.73 ascon128abi32v12 15.40 15.49 15.56 ascon128bi32v12 18.93 18.93 18.96 T:isapa128v20 19.73 19.80 19.81 T:schwaemm256128v2 20.31 20.40 20.50 T:grain128aeadv2 21.32 21.33 21.43 T:isapa128av20 24.71 24.82 25.20 T:schwaemm256256v2 25.03 25.05 25.10 romulusn 26.91 26.94 26.98 T:schwaemm192192v2 30.48 30.52 30.57 T:schwaemm128128v2 32.24 32.77 32.77 T:giftcofb128v1 33.96 34.01 34.28 romulusm 34.77 34.98 35.36 T:isapk128av20 36.13 36.19 36.29 romulust 32.09? 36.70? 37.35? T:xoodyakround3 39.46 39.52 39.60 T:tinyjambu128v2 42.60 43.07 43.31 T:tinyjambu256v2 43.38? 43.40? 60.70? T:tinyjambu192v2 60.41 61.64 61.87 T:isapk128v20 78.52 79.76 80.24 T:elephant200v2 242.76 243.92 250.41 T:isapxv20 4360.41 4416.95 4418.32 T:elephant176v2 5296.54 5333.43 5342.68 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 4.34 4.62 4.62 T:aes128gcmv1 4.62 4.91 4.91 aes256gcmv1 7.80 8.09 8.09 ascon128av12 9.83 9.83 9.83 ascon80pqv12 10.12 10.12 10.41 ascon128v12 15.90 16.19 16.19 ascon128abi32v12 21.68 21.97 22.26 ascon128bi32v12 27.46 27.75 28.62 T:grain128aeadv2 29.77 29.77 30.06 romulusn 32.09 32.38 32.38 T:schwaemm256128v2 39.02 39.31 39.60 T:giftcofb128v1 39.31 39.60 40.18 T:schwaemm256256v2 39.89 39.89 40.18 romulusm 40.18 40.47 40.76 T:schwaemm128128v2 42.78 43.07 43.07 T:schwaemm192192v2 45.67 45.96 46.25 T:xoodyakround3 46.83 47.12 47.41 T:tinyjambu128v2 50.30 50.30 50.59 T:tinyjambu256v2 50.88 50.88 51.16 T:tinyjambu192v2 94.52 95.10 95.10 romulust 106.09 106.38 106.95 T:isapa128av20 113.31 113.89 114.18 T:elephant200v2 164.77 165.63 166.21 T:isapk128av20 251.20 253.51 253.80 T:isapa128v20 930.78 935.41 938.30 T:isapk128v20 3917.38 3919.69 3961.60 T:isapxv20 5450.27 5483.80 5500.57 T:elephant176v2 7110.36 7129.44 7150.54 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 4.34 4.34 4.34 T:aes128gcmv1 4.62 4.62 4.62 aes256gcmv1 7.80 7.80 8.09 ascon128av12 9.83 9.83 9.83 ascon80pqv12 10.12 10.12 10.41 ascon128v12 16.19 16.19 16.19 ascon128abi32v12 22.26 22.26 22.55 ascon128bi32v12 28.04 28.33 28.91 T:grain128aeadv2 30.06 30.06 30.06 romulusn 32.38 32.38 32.38 T:schwaemm256128v2 38.73 39.02 39.60 T:schwaemm128128v2 39.31 39.31 39.89 T:schwaemm256256v2 39.31 39.60 39.89 T:giftcofb128v1 40.76 41.34 41.62 romulusm 43.36 43.36 43.36 T:schwaemm192192v2 45.67 45.96 45.96 T:xoodyakround3 46.83 47.12 47.70 T:tinyjambu128v2 50.30 50.30 50.88 T:tinyjambu256v2 50.88 51.16 51.16 T:tinyjambu192v2 94.52 95.39 95.39 romulust 105.80 106.09 107.53 T:isapa128av20 113.02 114.47 114.76 T:elephant200v2 164.77 166.21 166.79 T:isapk128av20 251.77 253.51 253.80 T:isapa128v20 918.35 923.84 928.18 T:isapk128v20 3901.48 3902.63 3946.28 T:isapxv20 5447.67 5476.87 5482.65 T:elephant176v2 7112.67 7150.25 7151.12 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 4.34 4.34 4.34 T:aes128gcmv1 4.62 4.62 4.62 aes256gcmv1 7.80 7.80 7.80 ascon128av12 9.83 9.83 9.83 ascon80pqv12 10.12 10.12 10.12 ascon128v12 16.19 16.19 16.19 ascon128abi32v12 22.26 22.26 22.55 ascon128bi32v12 27.46 28.04 28.04 T:grain128aeadv2 30.06 30.06 30.06 romulusn 32.38 32.38 32.66 T:schwaemm256128v2 38.45 38.73 39.02 T:schwaemm128128v2 39.31 39.60 39.60 T:giftcofb128v1 39.31 39.60 39.89 T:schwaemm256256v2 41.05 41.34 41.91 romulusm 43.07 43.36 43.36 T:schwaemm192192v2 45.67 45.67 46.25 T:xoodyakround3 46.83 46.83 47.12 T:tinyjambu128v2 50.30 50.30 50.59 T:tinyjambu256v2 50.88 51.16 51.16 T:tinyjambu192v2 59.26 59.55 59.84 romulust 63.30 63.59 63.88 T:isapa128av20 102.91 103.48 103.77 T:isapk128av20 113.02 113.89 114.18 T:elephant200v2 131.52 132.39 132.68 T:isapa128v20 478.98 492.56 498.05 T:isapk128v20 2036.73 2038.76 2063.33 T:isapxv20 5448.25 5478.89 5508.38 T:elephant176v2 7117.59 7151.12 7191.01 T:elephant160v2