VAMPIRE

eBACS: ECRYPT Benchmarking of Cryptographic Systems


ECRYPT II
General information:IntroductioneBASHeBASCeBAEADeBATSSUPERCOPXBXComputersArch
How to submit new software:Tipshashstreamaeaddhkemencryptsign
List of primitives measured:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
Measurements:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
List of subroutines:verifydecodeencodesortcorehashblocksxofscalarmult

Measurements of NISTLWC cipher candidates on one machine: amd64; Haswell+AES (306c3); 2013 Intel Xeon E3-1275 V3; 4 x 3500MHz; titan0, supercop-20240716

[Page version: 20240726 23:46:23]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.


Implementation notes

Graphs: (bytes,cycles)
Cycles/byte for long+0 encrypt
25%50%75%aead
1.021.071.11T:aes128gcmv1
1.251.351.38T:aes256gcmv1
7.197.217.22ascon128av12
10.5710.6010.63ascon128v12
10.6210.6510.72ascon80pqv12
14.3314.3514.38ascon128abi32v12
17.6117.6917.77T:xoodyakround3
19.2619.2919.36T:schwaemm256128v2
21.0621.0921.12ascon128bi32v12
23.6923.7223.75T:schwaemm256256v2
25.2725.3725.44T:schwaemm192192v2
27.1527.2027.40T:grain128aeadv2
28.0128.0628.08T:schwaemm128128v2
39.2139.5339.60romulusn
40.7240.9241.02T:isapa128av20
40.7641.0441.35T:isapa128v20
41.5941.6441.66T:giftcofb128v1
61.5261.6061.94T:tinyjambu128v2
63.5363.6163.78romulusm
71.6971.7972.01T:isapk128av20
74.1274.1874.23T:tinyjambu192v2
82.3182.3282.32T:tinyjambu256v2
95.1295.3395.62T:isapk128v20
124.97125.05125.46romulust
159.20159.39159.70T:elephant200v2
188.18190.36192.97T:isapxv20
280.64280.81280.93aes256gcmv1
7184.167187.917190.78T:elephant176v2
8737.588738.358739.02T:elephant160v2
Cycles/byte for long+0 decrypt
25%50%75%aead
0.94?1.03?1.08?T:aes128gcmv1
1.19?1.31?1.35?T:aes256gcmv1
7.157.187.19ascon128av12
10.3410.4010.63ascon128v12
10.5910.6210.66ascon80pqv12
14.4214.4514.48ascon128abi32v12
17.1717.2117.25T:xoodyakround3
19.2219.2619.34T:schwaemm256128v2
21.3521.3921.42ascon128bi32v12
23.6923.7223.75T:schwaemm256256v2
26.0526.0926.14T:schwaemm192192v2
28.0128.0528.11T:schwaemm128128v2
28.2828.3128.33T:grain128aeadv2
39.5039.5439.57romulusn
40.7940.8741.28T:isapa128v20
40.9040.9941.07T:isapa128av20
41.6441.7041.74T:giftcofb128v1
61.3661.4461.95T:tinyjambu128v2
63.5263.5563.67romulusm
71.5471.7571.94T:isapk128av20
74.1574.1974.23T:tinyjambu192v2
82.2882.3082.31T:tinyjambu256v2
95.0395.3795.52T:isapk128v20
125.06125.19125.55romulust
159.10159.54159.83T:elephant200v2
185.07?190.98?226.59?T:isapxv20
280.51280.72280.91aes256gcmv1
7183.427186.937188.43T:elephant176v2
8736.718737.948738.68T:elephant160v2
Cycles/byte for long+0 forgery
25%50%75%aead
0.95?1.03?1.09?T:aes128gcmv1
1.221.281.32T:aes256gcmv1
7.147.167.19ascon128av12
10.5810.6010.61ascon80pqv12
10.5510.6210.64ascon128v12
14.4314.4414.46ascon128abi32v12
17.2017.3117.34T:xoodyakround3
19.2319.2719.31T:schwaemm256128v2
19.9920.0720.40T:isapa128v20
21.3821.4021.43ascon128bi32v12
23.7023.7223.75T:schwaemm256256v2
26.0226.1126.15T:schwaemm192192v2
27.9928.0428.10T:isapa128av20
28.0228.0728.09T:schwaemm128128v2
28.2528.2828.29T:grain128aeadv2
39.5139.5339.56romulusn
41.6541.6941.73T:giftcofb128v1
42.7742.8542.91romulust
47.5047.6647.80T:isapk128av20
59.3059.5259.67T:isapk128v20
61.3961.5061.96T:tinyjambu128v2
63.4963.5163.69romulusm
74.1474.2274.28T:tinyjambu192v2
82.2982.3182.33T:tinyjambu256v2
108.81?113.43?148.29?T:isapxv20
159.22159.51159.96T:elephant200v2
268.72268.81269.25aes256gcmv1
7184.027185.577191.85T:elephant176v2
8737.468738.458739.46T:elephant160v2
Cycles/byte for long+long encrypt
25%50%75%aead
0.730.750.78T:aes128gcmv1
0.860.870.89T:aes256gcmv1
7.157.177.19ascon128av12
10.5810.6110.63ascon128v12
10.6210.6510.69ascon80pqv12
13.3313.3813.43T:xoodyakround3
14.4614.4814.51ascon128abi32v12
19.1019.1419.16T:schwaemm256128v2
21.2421.2821.30ascon128bi32v12
23.5923.6023.61T:schwaemm256256v2
25.1325.1725.25T:schwaemm192192v2
27.2027.2627.33T:grain128aeadv2
27.8427.8627.94T:schwaemm128128v2
30.2430.4130.62T:isapa128v20
31.5931.7032.01romulusn
34.4634.4934.51T:isapa128av20
41.5341.5741.59T:giftcofb128v1
43.6843.7343.79romulusm
50.6450.6850.78T:tinyjambu128v2
58.1358.1658.25T:tinyjambu192v2
59.5959.6859.74T:isapk128av20
62.1662.1762.19T:tinyjambu256v2
77.2777.5077.71T:isapk128v20
83.7583.8283.98romulust
119.73119.95120.13T:elephant200v2
150.49151.35152.58T:isapxv20
274.75275.29275.58aes256gcmv1
5364.185365.555366.00T:elephant176v2
6553.626554.026555.04T:elephant160v2
Cycles/byte for long+long decrypt
25%50%75%aead
0.700.720.76T:aes128gcmv1
0.820.840.89T:aes256gcmv1
7.157.167.17ascon128av12
10.5010.5310.55ascon128v12
10.6110.6310.65ascon80pqv12
13.1113.1413.16T:xoodyakround3
14.3514.4214.46ascon128abi32v12
19.0719.1119.15T:schwaemm256128v2
21.5121.5321.54ascon128bi32v12
23.5923.6123.64T:schwaemm256256v2
25.4725.5325.63T:schwaemm192192v2
27.7727.8027.81T:grain128aeadv2
27.8627.8827.92T:schwaemm128128v2
30.4430.5930.77T:isapa128v20
31.7531.8132.17romulusn
34.4634.5234.55T:isapa128av20
41.5641.5941.61T:giftcofb128v1
43.7543.8043.85romulusm
50.5750.6951.00T:tinyjambu128v2
58.1358.1758.23T:tinyjambu192v2
59.5459.6859.83T:isapk128av20
62.1662.1662.18T:tinyjambu256v2
77.3177.4977.74T:isapk128v20
83.7383.8283.99romulust
119.56119.80120.06T:elephant200v2
147.48?151.67?185.96?T:isapxv20
274.54274.64274.88aes256gcmv1
5364.155365.435366.43T:elephant176v2
6553.806554.326555.10T:elephant160v2
Cycles/byte for long+long forgery
25%50%75%aead
0.700.720.75T:aes128gcmv1
0.840.860.87T:aes256gcmv1
7.157.187.20ascon128av12
10.5110.5310.55ascon128v12
10.6010.6310.64ascon80pqv12
13.1213.1513.20T:xoodyakround3
14.4014.4414.47ascon128abi32v12
19.1019.1319.14T:schwaemm256128v2
19.9820.0920.20T:isapa128v20
21.5021.5321.55ascon128bi32v12
23.5923.6023.63T:schwaemm256256v2
25.4725.5425.65T:schwaemm192192v2
27.7827.7927.80T:grain128aeadv2
27.8527.8827.91T:schwaemm128128v2
28.0228.0428.06T:isapa128av20
31.7031.8032.17romulusn
41.5641.5841.60T:giftcofb128v1
42.6442.7142.74romulust
43.7943.8643.89romulusm
47.5647.6547.74T:isapk128av20
50.4850.6250.99T:tinyjambu128v2
58.1358.1958.24T:tinyjambu192v2
59.4559.5559.65T:isapk128v20
62.1662.1762.18T:tinyjambu256v2
109.56?113.04?146.76?T:isapxv20
119.62119.76119.99T:elephant200v2
268.71268.98269.10aes256gcmv1
5364.105365.045366.49T:elephant176v2
6554.056554.766555.60T:elephant160v2
Cycles/byte for 0+long encrypt
25%50%75%aead
0.390.410.43T:aes256gcmv1
0.37?0.42?0.46?T:aes128gcmv1
7.107.137.15ascon128av12
9.039.069.08T:xoodyakround3
10.5910.6010.62ascon128v12
10.5910.6110.64ascon80pqv12
14.3614.4014.41ascon128abi32v12
18.9018.9318.97T:schwaemm256128v2
19.6919.9820.37T:isapa128v20
21.4221.4721.55ascon128bi32v12
23.4523.5123.53T:schwaemm256256v2
23.8523.9424.07romulusm
23.8724.0624.80romulusn
24.9325.0225.08T:schwaemm192192v2
27.2327.2427.27T:grain128aeadv2
27.6327.6727.68T:schwaemm128128v2
28.0028.0628.10T:isapa128av20
39.6539.8239.88T:tinyjambu128v2
41.4241.4541.49T:giftcofb128v1
42.0842.0942.11T:tinyjambu256v2
42.2042.3442.40T:tinyjambu192v2
42.4842.5442.63romulust
47.5147.6247.76T:isapk128av20
59.3159.5859.82T:isapk128v20
80.2880.6681.16T:elephant200v2
111.51112.34113.89T:isapxv20
268.65268.81269.09aes256gcmv1
3545.483546.953549.33T:elephant176v2
4371.354372.254373.67T:elephant160v2
Cycles/byte for 0+long decrypt
25%50%75%aead
0.37?0.41?0.44?T:aes256gcmv1
0.39?0.42?0.45?T:aes128gcmv1
7.157.167.18ascon128av12
9.009.039.07T:xoodyakround3
10.4610.4810.50ascon128v12
10.5910.6110.64ascon80pqv12
14.3814.4114.43ascon128abi32v12
18.9018.9418.99T:schwaemm256128v2
19.6620.3020.36T:isapa128v20
21.6221.6321.66ascon128bi32v12
23.4323.4823.53T:schwaemm256256v2
23.8924.0224.06romulusm
23.9124.0524.82romulusn
24.9425.0025.09T:schwaemm192192v2
27.2427.2727.30T:grain128aeadv2
27.6627.7027.76T:schwaemm128128v2
28.0128.0528.08T:isapa128av20
39.8239.8839.96T:tinyjambu128v2
41.4241.4841.50T:giftcofb128v1
42.0642.0742.08T:tinyjambu256v2
42.1942.2942.34T:tinyjambu192v2
42.4542.5342.55romulust
47.4947.6447.79T:isapk128av20
59.3459.5159.97T:isapk128v20
80.2880.6881.09T:elephant200v2
107.90?112.65?147.74?T:isapxv20
269.04269.18269.53aes256gcmv1
3545.713546.783548.29T:elephant176v2
4371.274371.604373.80T:elephant160v2
Cycles/byte for 0+long forgery
25%50%75%aead
0.37?0.40?0.42?T:aes256gcmv1
0.39?0.42?0.44?T:aes128gcmv1
7.167.177.18ascon128av12
9.029.059.08T:xoodyakround3
10.4610.4810.51ascon128v12
10.5810.6110.63ascon80pqv12
14.4014.4214.43ascon128abi32v12
18.8818.9218.95T:schwaemm256128v2
19.9320.1720.35T:isapa128v20
21.6121.6321.65ascon128bi32v12
23.4723.5023.54T:schwaemm256256v2
23.9124.0224.05romulusm
23.9424.0624.81romulusn
24.9325.0125.07T:schwaemm192192v2
27.2427.2827.31T:grain128aeadv2
27.6327.6627.69T:schwaemm128128v2
28.0428.0828.11T:isapa128av20
39.8139.8540.03T:tinyjambu128v2
41.4341.4841.50T:giftcofb128v1
42.0542.0742.08T:tinyjambu256v2
42.1342.2942.31T:tinyjambu192v2
42.5042.5542.59romulust
47.5547.7347.80T:isapk128av20
59.4059.5559.78T:isapk128v20
80.2880.5480.86T:elephant200v2
107.90?112.63?147.71?T:isapxv20
269.04269.17269.26aes256gcmv1
3545.713546.713547.97T:elephant176v2
4371.194371.674373.29T:elephant160v2
Cycles/byte for 1536+1536 encrypt
25%50%75%aead
1.931.941.94T:aes128gcmv1
2.082.082.09T:aes256gcmv1
7.347.357.36ascon128av12
10.7610.7710.79ascon128v12
10.8110.8210.85ascon80pqv12
13.4913.5213.55T:xoodyakround3
14.7914.8114.83ascon128abi32v12
19.6819.7119.74T:schwaemm256128v2
21.6421.6721.70ascon128bi32v12
24.2324.2524.27T:schwaemm256256v2
25.7125.7425.79T:schwaemm192192v2
27.7227.7427.75T:grain128aeadv2
28.2428.2628.28T:schwaemm128128v2
31.9232.0232.28romulusn
37.0237.0437.07T:isapa128av20
41.9141.9341.95T:giftcofb128v1
43.9143.9844.08romulusm
44.3344.3744.51T:isapa128v20
51.0951.1451.16T:tinyjambu128v2
58.6058.6258.68T:tinyjambu192v2
62.6562.6562.66T:tinyjambu256v2
66.9467.0267.07T:isapk128av20
85.0685.1185.30romulust
122.39122.42122.48T:elephant200v2
133.63133.77133.94T:isapk128v20
248.37249.69249.72T:isapxv20
276.35276.39276.53aes256gcmv1
5405.595405.905407.99T:elephant176v2
6628.116628.276628.91T:elephant160v2
Cycles/byte for 1536+1536 decrypt
25%50%75%aead
1.921.931.95T:aes128gcmv1
2.062.072.08T:aes256gcmv1
7.337.357.37ascon128av12
10.6810.6910.71ascon128v12
10.7910.8010.82ascon80pqv12
13.2813.2913.31T:xoodyakround3
14.7014.7414.77ascon128abi32v12
19.6619.6819.73T:schwaemm256128v2
21.8921.9221.93ascon128bi32v12
24.2324.2624.29T:schwaemm256256v2
26.0426.1226.17T:schwaemm192192v2
28.2228.2328.24T:grain128aeadv2
28.2628.2728.30T:schwaemm128128v2
32.0032.1132.44romulusn
37.0337.0637.09T:isapa128av20
41.9241.9441.97T:giftcofb128v1
44.1244.1844.21romulusm
44.2644.5044.54T:isapa128v20
50.9951.0451.34T:tinyjambu128v2
58.6058.6658.69T:tinyjambu192v2
62.6562.6562.66T:tinyjambu256v2
67.0267.0567.22T:isapk128av20
85.0685.1885.25romulust
122.36122.48122.62T:elephant200v2
133.78133.82134.04T:isapk128v20
248.14?249.77?281.20?T:isapxv20
276.21276.33276.45aes256gcmv1
5405.435405.705406.64T:elephant176v2
6627.906628.576629.58T:elephant160v2
Cycles/byte for 1536+1536 forgery
25%50%75%aead
1.911.921.93T:aes128gcmv1
2.052.062.07T:aes256gcmv1
7.327.347.36ascon128av12
10.6710.6810.69ascon128v12
10.7810.7910.80ascon80pqv12
13.2913.3113.33T:xoodyakround3
14.7014.7514.76ascon128abi32v12
19.6719.6919.74T:schwaemm256128v2
21.8821.9021.92ascon128bi32v12
24.2224.2524.28T:schwaemm256256v2
26.0626.1026.16T:schwaemm192192v2
27.2127.2327.25T:isapa128v20
28.2028.2228.24T:grain128aeadv2
28.2428.2528.28T:schwaemm128128v2
29.4829.5029.51T:isapa128av20
32.0232.1132.42romulusn
41.9641.9741.98T:giftcofb128v1
43.8943.9243.94romulust
44.1444.2044.25romulusm
50.8451.0651.37T:tinyjambu128v2
51.9752.0152.13T:isapk128av20
58.6258.6858.71T:tinyjambu192v2
62.6562.6562.67T:tinyjambu256v2
88.3488.4288.57T:isapk128v20
122.30122.45122.61T:elephant200v2
162.30?163.26?194.65?T:isapxv20
270.50270.73270.94aes256gcmv1
5405.605406.375407.40T:elephant176v2
6628.096628.816629.57T:elephant160v2
Cycles/byte for 64+64 encrypt
25%50%75%aead
11.2911.3711.62ascon128av12
14.3814.4214.49ascon128v12
14.5514.6914.77ascon80pqv12
19.5519.7120.02T:xoodyakround3
22.0122.2722.41ascon128abi32v12
29.9330.0030.34ascon128bi32v12
29.8830.0330.59T:aes128gcmv1
30.7731.0431.31T:aes256gcmv1
32.2032.3032.61T:schwaemm256128v2
36.1336.2836.66T:schwaemm128128v2
37.0937.1237.16T:grain128aeadv2
38.5338.7038.88romulusn
38.6938.8839.01T:schwaemm256256v2
41.5241.8642.22T:schwaemm192192v2
50.0550.1250.26T:giftcofb128v1
50.5850.7350.91romulusm
60.2360.4560.70T:tinyjambu128v2
68.8469.0269.17T:tinyjambu192v2
73.3473.7374.00T:tinyjambu256v2
94.3894.5995.48T:isapa128av20
113.80114.18114.59romulust
173.66175.27175.98T:elephant200v2
219.77220.20221.42T:isapk128av20
312.80313.18313.67aes256gcmv1
361.23365.40366.68T:isapa128v20
1405.041406.361407.14T:isapk128v20
2445.772482.972484.08T:isapxv20
6732.436736.706762.88T:elephant176v2
8878.788880.798882.33T:elephant160v2
Cycles/byte for 64+64 decrypt
25%50%75%aead
11.3611.4111.74ascon128av12
14.2414.3514.51ascon128v12
14.6514.7514.80ascon80pqv12
19.4819.6220.09T:xoodyakround3
21.9922.0422.56ascon128abi32v12
29.4829.8130.07T:aes128gcmv1
30.3030.4530.67ascon128bi32v12
30.2630.7031.00T:aes256gcmv1
32.0532.1632.49T:schwaemm256128v2
36.1736.4336.67T:schwaemm128128v2
37.6137.6537.69T:grain128aeadv2
38.8538.9138.97T:schwaemm256256v2
38.8038.9439.34romulusn
41.8942.0542.21T:schwaemm192192v2
50.1250.2050.55T:giftcofb128v1
52.2552.4552.64romulusm
60.1260.5260.76T:tinyjambu128v2
68.8868.9869.31T:tinyjambu192v2
73.4173.5973.75T:tinyjambu256v2
94.3494.8795.03T:isapa128av20
114.00114.22114.99romulust
174.05174.41174.86T:elephant200v2
219.27220.57221.90T:isapk128av20
312.77313.20313.65aes256gcmv1
364.81365.90366.34T:isapa128v20
1404.991407.181408.33T:isapk128v20
2445.292478.912527.99T:isapxv20
6732.486735.006747.13T:elephant176v2
8878.678880.158881.45T:elephant160v2
Cycles/byte for 64+64 forgery
25%50%75%aead
11.3011.3511.42ascon128av12
14.2614.3714.55ascon128v12
14.7014.7714.89ascon80pqv12
19.4819.7319.98T:xoodyakround3
21.9522.1122.27ascon128abi32v12
29.4129.6229.77T:aes128gcmv1
30.1630.2030.27T:aes256gcmv1
30.2630.4030.47ascon128bi32v12
32.0532.1232.24T:schwaemm256128v2
36.0336.1636.44T:schwaemm128128v2
37.5937.6337.72T:grain128aeadv2
38.5938.7339.13romulusn
38.7438.8038.96T:schwaemm256256v2
41.8742.1642.31T:schwaemm192192v2
50.0850.1850.27T:giftcofb128v1
52.3052.4652.67romulusm
59.9960.3760.74T:tinyjambu128v2
62.1862.2962.53T:isapa128av20
68.8169.0869.15T:tinyjambu192v2
71.8472.0072.33romulust
73.4473.4773.55T:tinyjambu256v2
138.56139.12140.51T:isapk128av20
173.13173.86175.77T:elephant200v2
187.83188.09188.60T:isapa128v20
307.51307.89308.48aes256gcmv1
735.80737.23738.88T:isapk128v20
1279.921297.161342.68T:isapxv20
6732.236734.286737.73T:elephant176v2
8879.058880.958882.34T:elephant160v2