VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: amd64; Haswell+AES (306c3); 2013 Intel Xeon E3-1275 V3; 4 x 3500MHz; titan0, supercop-20251222

[Page version: 20260107 17:54:08]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 1.78 1.80 1.80 T:aes128gcmv1 2.12 2.14 2.15 aes256gcmv1 7.19 7.21 7.23 ascon128av12 10.59 10.61 10.68 ascon80pqv12 10.59 10.61 10.63 ascon128v12 14.33 14.36 14.38 ascon128abi32v12 17.60 17.69 17.73 T:xoodyakround3 19.19 19.23 19.27 T:schwaemm256128v2 21.74 21.78 21.82 ascon128bi32v12 23.69 23.72 24.00 T:schwaemm256256v2 25.27 25.30 25.37 T:schwaemm192192v2 27.15 27.25 27.44 T:grain128aeadv2 28.00 28.07 28.09 T:schwaemm128128v2 39.10 39.16 39.53 romulusn 40.75 40.95 41.03 T:isapa128av20 40.95 41.40 41.48 T:isapa128v20 41.88 41.93 41.97 T:giftcofb128v1 61.52 61.55 61.59 T:tinyjambu128v2 62.36 62.45 62.52 romulusm 71.52 71.77 72.01 T:isapk128av20 74.14 74.17 74.24 T:tinyjambu192v2 82.30 82.32 82.32 T:tinyjambu256v2 95.26 95.50 95.77 T:isapk128v20 125.04 125.08 125.17 romulust 159.05 159.20 159.33 T:elephant200v2 186.70? 190.79? 217.67? T:isapxv20 7184.16 7184.85 7186.11 T:elephant176v2 8736.74 8738.94 8758.31 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 1.83 1.84 1.85 T:aes128gcmv1 2.22 2.25 2.26 aes256gcmv1 7.11 7.16 7.17 ascon128av12 10.57 10.62 10.63 ascon128v12 10.60 10.63 10.66 ascon80pqv12 14.41 14.45 14.51 ascon128abi32v12 17.18 17.28 17.32 T:xoodyakround3 19.18 19.24 19.27 T:schwaemm256128v2 21.37 21.41 21.45 ascon128bi32v12 23.66 23.70 23.98 T:schwaemm256256v2 25.26 25.34 26.11 T:schwaemm192192v2 28.02 28.07 28.10 T:schwaemm128128v2 28.27 28.30 28.32 T:grain128aeadv2 39.47 39.49 39.53 romulusn 40.45 40.80 41.47 T:isapa128v20 40.91 40.98 41.04 T:isapa128av20 41.86 41.91 41.95 T:giftcofb128v1 61.38 61.42 61.49 T:tinyjambu128v2 62.49 62.56 62.63 romulusm 71.60 71.86 72.07 T:isapk128av20 74.12 74.18 74.25 T:tinyjambu192v2 82.29 82.30 82.32 T:tinyjambu256v2 95.07 95.38 95.70 T:isapk128v20 125.07 125.15 125.22 romulust 159.10 159.35 159.54 T:elephant200v2 186.44? 191.13? 217.20? T:isapxv20 7184.16 7184.86 7187.60 T:elephant176v2 8737.04 8738.90 8758.72 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 1.83 1.83 1.84 T:aes128gcmv1 2.21 2.23 2.26 aes256gcmv1 7.14 7.15 7.18 ascon128av12 10.44 10.58 10.62 ascon128v12 10.59 10.64 10.66 ascon80pqv12 14.43 14.47 14.48 ascon128abi32v12 17.20 17.26 17.33 T:xoodyakround3 19.18 19.24 19.27 T:schwaemm256128v2 19.72 20.10 20.38 T:isapa128v20 21.35 21.39 21.44 ascon128bi32v12 23.66 23.70 23.98 T:schwaemm256256v2 25.27 25.35 26.03 T:schwaemm192192v2 28.00 28.05 28.12 T:isapa128av20 28.01 28.05 28.09 T:schwaemm128128v2 28.27 28.29 28.31 T:grain128aeadv2 39.46 39.49 39.54 romulusn 41.87 41.92 41.96 T:giftcofb128v1 42.80 42.86 42.93 romulust 47.59 47.70 47.85 T:isapk128av20 59.36 59.51 59.76 T:isapk128v20 61.36 61.43 61.50 T:tinyjambu128v2 62.46 62.52 62.60 romulusm 74.15 74.18 74.26 T:tinyjambu192v2 82.29 82.31 82.32 T:tinyjambu256v2 111.87 113.18 114.92 T:isapxv20 158.99 159.30 159.57 T:elephant200v2 7184.43 7185.90 7186.84 T:elephant176v2 8736.77 8739.08 8758.32 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 1.19 1.20 1.22 T:aes128gcmv1 1.38 1.40 1.41 aes256gcmv1 7.16 7.18 7.19 ascon128av12 10.60 10.62 10.63 ascon128v12 10.62 10.66 10.67 ascon80pqv12 13.33 13.38 13.41 T:xoodyakround3 14.40 14.50 14.51 ascon128abi32v12 19.01 19.04 19.08 T:schwaemm256128v2 21.60 21.64 21.79 ascon128bi32v12 23.62 23.64 23.91 T:schwaemm256256v2 25.11 25.15 25.18 T:schwaemm192192v2 27.20 27.32 27.35 T:grain128aeadv2 27.85 27.86 27.88 T:schwaemm128128v2 30.34 30.46 30.70 T:isapa128v20 31.57 31.60 31.68 romulusn 34.36 34.46 34.49 T:isapa128av20 41.80 41.81 41.84 T:giftcofb128v1 43.19 43.24 43.27 romulusm 50.59 50.67 50.72 T:tinyjambu128v2 58.13 58.17 58.22 T:tinyjambu192v2 59.54 59.68 59.77 T:isapk128av20 62.16 62.17 62.19 T:tinyjambu256v2 77.76 77.87 77.95 T:isapk128v20 83.79 83.85 83.99 romulust 119.60 119.68 119.82 T:elephant200v2 149.67 151.58 164.98 T:isapxv20 5363.93 5364.57 5366.46 T:elephant176v2 6555.53 6555.74 6556.13 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 1.22 1.23 1.24 T:aes128gcmv1 1.41 1.43 1.44 aes256gcmv1 7.15 7.17 7.19 ascon128av12 10.50 10.52 10.53 ascon128v12 10.60 10.62 10.65 ascon80pqv12 13.12 13.17 13.18 T:xoodyakround3 14.38 14.46 14.47 ascon128abi32v12 19.02 19.05 19.09 T:schwaemm256128v2 21.60 21.72 21.75 ascon128bi32v12 23.61 23.63 23.90 T:schwaemm256256v2 25.10 25.14 25.50 T:schwaemm192192v2 27.78 27.80 27.85 T:grain128aeadv2 27.87 27.89 27.93 T:schwaemm128128v2 30.36 30.43 30.67 T:isapa128v20 31.79 31.83 31.86 romulusn 34.41 34.48 34.51 T:isapa128av20 41.80 41.83 41.85 T:giftcofb128v1 43.28 43.31 43.33 romulusm 50.56 50.61 50.63 T:tinyjambu128v2 58.16 58.18 58.20 T:tinyjambu192v2 59.58 59.68 59.81 T:isapk128av20 62.16 62.17 62.19 T:tinyjambu256v2 77.83 77.95 78.23 T:isapk128v20 83.79 83.84 83.87 romulust 119.59 119.78 119.91 T:elephant200v2 149.25 151.72 164.83 T:isapxv20 5363.99 5364.30 5366.43 T:elephant176v2 6554.16 6555.51 6556.01 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 1.21 1.22 1.23 T:aes128gcmv1 1.41 1.42 1.44 aes256gcmv1 7.14 7.17 7.18 ascon128av12 10.49 10.51 10.54 ascon128v12 10.62 10.64 10.66 ascon80pqv12 13.11 13.17 13.20 T:xoodyakround3 14.38 14.46 14.47 ascon128abi32v12 19.01 19.05 19.08 T:schwaemm256128v2 19.94 20.01 20.05 T:isapa128v20 21.55 21.60 21.72 ascon128bi32v12 23.62 23.65 23.91 T:schwaemm256256v2 25.11 25.17 25.52 T:schwaemm192192v2 27.79 27.81 27.85 T:grain128aeadv2 27.85 27.88 27.91 T:schwaemm128128v2 28.04 28.06 28.08 T:isapa128av20 31.79 31.83 31.85 romulusn 41.81 41.83 41.85 T:giftcofb128v1 42.66 42.69 42.73 romulust 43.28 43.30 43.32 romulusm 47.56 47.66 47.82 T:isapk128av20 50.58 50.60 50.64 T:tinyjambu128v2 58.15 58.20 58.23 T:tinyjambu192v2 59.87 59.99 60.11 T:isapk128v20 62.16 62.17 62.18 T:tinyjambu256v2 112.06 112.76 113.81 T:isapxv20 119.59 119.71 119.86 T:elephant200v2 5363.88 5364.69 5367.47 T:elephant176v2 6555.30 6555.99 6556.42 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.61 0.62 0.65 T:aes128gcmv1 0.61 0.63 0.65 aes256gcmv1 7.10 7.13 7.15 ascon128av12 9.02 9.05 9.08 T:xoodyakround3 10.57 10.59 10.63 ascon80pqv12 10.60 10.62 10.63 ascon128v12 14.38 14.41 14.43 ascon128abi32v12 18.82 18.86 18.89 T:schwaemm256128v2 19.98 20.02 20.06 T:isapa128v20 21.41 21.44 21.46 ascon128bi32v12 23.53 23.56 23.82 T:schwaemm256256v2 23.97 24.00 24.13 romulusn 24.03 24.06 24.11 romulusm 24.91 24.95 25.02 T:schwaemm192192v2 27.24 27.27 27.37 T:grain128aeadv2 27.62 27.66 27.73 T:schwaemm128128v2 28.00 28.04 28.09 T:isapa128av20 39.78 39.84 39.87 T:tinyjambu128v2 41.66 41.71 41.73 T:giftcofb128v1 42.08 42.08 42.10 T:tinyjambu256v2 42.30 42.32 42.35 T:tinyjambu192v2 42.51 42.54 42.58 romulust 47.48 47.63 47.79 T:isapk128av20 60.19 60.37 60.57 T:isapk128v20 80.30 80.47 80.75 T:elephant200v2 111.54 112.67 113.90 T:isapxv20 3547.08 3548.12 3548.78 T:elephant176v2 4371.69 4373.46 4376.42 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.59 0.60 0.62 aes256gcmv1 0.60 0.63 0.64 T:aes128gcmv1 7.14 7.17 7.19 ascon128av12 9.02 9.05 9.07 T:xoodyakround3 10.45 10.48 10.50 ascon128v12 10.59 10.61 10.63 ascon80pqv12 14.39 14.41 14.43 ascon128abi32v12 18.83 18.89 18.92 T:schwaemm256128v2 19.88 20.02 20.10 T:isapa128v20 21.69 21.73 21.75 ascon128bi32v12 23.53 23.56 23.82 T:schwaemm256256v2 23.98 24.00 24.15 romulusn 24.05 24.06 24.09 romulusm 24.90 24.93 24.98 T:schwaemm192192v2 27.25 27.29 27.40 T:grain128aeadv2 27.64 27.69 27.73 T:schwaemm128128v2 28.02 28.06 28.10 T:isapa128av20 39.79 39.84 39.88 T:tinyjambu128v2 41.66 41.73 41.76 T:giftcofb128v1 42.06 42.08 42.08 T:tinyjambu256v2 42.17 42.22 42.29 T:tinyjambu192v2 42.46 42.52 42.56 romulust 47.54 47.64 47.86 T:isapk128av20 60.20 60.34 60.57 T:isapk128v20 80.30 80.56 80.82 T:elephant200v2 111.02 112.37 114.04 T:isapxv20 3546.99 3548.22 3549.13 T:elephant176v2 4372.15 4373.49 4377.40 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.60 0.62 0.63 aes256gcmv1 0.61 0.62 0.65 T:aes128gcmv1 7.14 7.16 7.18 ascon128av12 9.02 9.05 9.07 T:xoodyakround3 10.45 10.47 10.50 ascon128v12 10.56 10.57 10.61 ascon80pqv12 14.40 14.41 14.43 ascon128abi32v12 18.82 18.88 18.89 T:schwaemm256128v2 19.95 20.05 20.10 T:isapa128v20 21.68 21.71 21.74 ascon128bi32v12 23.54 23.58 23.83 T:schwaemm256256v2 24.03 24.05 24.07 romulusm 24.01 24.06 24.20 romulusn 24.89 24.94 25.03 T:schwaemm192192v2 27.26 27.29 27.38 T:grain128aeadv2 27.64 27.69 27.72 T:schwaemm128128v2 28.01 28.06 28.09 T:isapa128av20 39.79 39.82 39.87 T:tinyjambu128v2 41.69 41.72 41.76 T:giftcofb128v1 42.06 42.07 42.08 T:tinyjambu256v2 42.18 42.25 42.32 T:tinyjambu192v2 42.49 42.52 42.58 romulust 47.48 47.65 47.87 T:isapk128av20 60.22 60.37 60.55 T:isapk128v20 80.30 80.56 80.76 T:elephant200v2 110.98 112.42 114.04 T:isapxv20 3546.93 3548.35 3549.23 T:elephant176v2 4371.02 4372.82 4373.83 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 1.37 1.38 1.39 T:aes128gcmv1 1.57 1.58 1.58 aes256gcmv1 7.34 7.35 7.36 ascon128av12 10.76 10.77 10.80 ascon128v12 10.80 10.83 10.85 ascon80pqv12 13.49 13.50 13.53 T:xoodyakround3 14.76 14.82 14.83 ascon128abi32v12 19.58 19.61 19.64 T:schwaemm256128v2 21.93 21.94 21.96 ascon128bi32v12 24.27 24.28 24.53 T:schwaemm256256v2 25.70 25.72 25.75 T:schwaemm192192v2 27.73 27.75 27.77 T:grain128aeadv2 28.22 28.24 28.26 T:schwaemm128128v2 31.88 31.92 32.04 romulusn 36.99 37.05 37.07 T:isapa128av20 42.14 42.17 42.18 T:giftcofb128v1 43.59 43.62 43.63 romulusm 44.24 44.29 44.46 T:isapa128v20 51.04 51.07 51.13 T:tinyjambu128v2 58.61 58.64 58.66 T:tinyjambu192v2 62.65 62.66 62.67 T:tinyjambu256v2 66.95 67.00 67.09 T:isapk128av20 85.09 85.11 85.17 romulust 122.07 122.24 122.32 T:elephant200v2 134.02 134.21 134.39 T:isapk128v20 248.36 250.09 261.22 T:isapxv20 5404.22 5404.82 5408.16 T:elephant176v2 6629.29 6629.82 6630.17 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 1.39 1.41 1.42 T:aes128gcmv1 1.59 1.61 1.62 aes256gcmv1 7.34 7.36 7.37 ascon128av12 10.67 10.68 10.69 ascon128v12 10.80 10.81 10.83 ascon80pqv12 13.27 13.29 13.33 T:xoodyakround3 14.74 14.76 14.79 ascon128abi32v12 19.59 19.60 19.62 T:schwaemm256128v2 21.92 22.01 22.03 ascon128bi32v12 24.27 24.28 24.53 T:schwaemm256256v2 25.71 25.76 26.01 T:schwaemm192192v2 28.23 28.24 28.27 T:grain128aeadv2 28.26 28.27 28.29 T:schwaemm128128v2 32.08 32.13 32.15 romulusn 36.99 37.05 37.08 T:isapa128av20 42.17 42.19 42.21 T:giftcofb128v1 43.72 43.74 43.76 romulusm 44.32 44.47 44.62 T:isapa128v20 50.98 51.02 51.05 T:tinyjambu128v2 58.63 58.68 58.71 T:tinyjambu192v2 62.64 62.64 62.65 T:tinyjambu256v2 66.95 67.03 67.11 T:isapk128av20 85.12 85.14 85.17 romulust 122.21 122.33 122.52 T:elephant200v2 134.13 134.24 134.40 T:isapk128v20 248.17 250.12 261.15 T:isapxv20 5404.25 5406.28 5407.45 T:elephant176v2 6629.10 6629.54 6629.97 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 1.39 1.40 1.41 T:aes128gcmv1 1.59 1.61 1.62 aes256gcmv1 7.34 7.34 7.36 ascon128av12 10.65 10.67 10.69 ascon128v12 10.80 10.81 10.84 ascon80pqv12 13.26 13.32 13.35 T:xoodyakround3 14.71 14.75 14.78 ascon128abi32v12 19.58 19.60 19.63 T:schwaemm256128v2 21.97 22.01 22.02 ascon128bi32v12 24.27 24.30 24.54 T:schwaemm256256v2 25.71 25.75 26.06 T:schwaemm192192v2 27.05 27.05 27.09 T:isapa128v20 28.21 28.23 28.27 T:grain128aeadv2 28.24 28.25 28.27 T:schwaemm128128v2 29.46 29.48 29.51 T:isapa128av20 32.11 32.12 32.15 romulusn 42.17 42.19 42.22 T:giftcofb128v1 43.72 43.74 43.76 romulusm 43.93 43.94 44.04 romulust 51.00 51.04 51.06 T:tinyjambu128v2 51.90 51.96 52.09 T:isapk128av20 58.60 58.66 58.71 T:tinyjambu192v2 62.64 62.65 62.66 T:tinyjambu256v2 88.81 88.92 89.04 T:isapk128v20 122.19 122.31 122.37 T:elephant200v2 162.27 163.08 163.48 T:isapxv20 5404.32 5405.75 5407.62 T:elephant176v2 6629.14 6629.45 6629.82 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 7.27 7.28 7.33 T:aes128gcmv1 7.92 7.98 8.05 aes256gcmv1 11.30 11.36 11.66 ascon128av12 14.38 14.42 14.63 ascon128v12 14.57 14.70 14.89 ascon80pqv12 19.36 19.45 19.82 T:xoodyakround3 21.95 22.22 22.53 ascon128abi32v12 28.73 28.79 29.09 ascon128bi32v12 31.85 31.98 32.23 T:schwaemm256128v2 36.27 36.49 36.84 T:schwaemm128128v2 37.13 37.20 37.52 T:grain128aeadv2 38.56 38.65 38.75 romulusn 38.70 38.84 39.05 T:schwaemm256256v2 41.43 41.81 42.08 T:schwaemm192192v2 50.07 50.20 50.44 T:giftcofb128v1 51.52 51.62 51.84 romulusm 60.04 60.31 60.80 T:tinyjambu128v2 68.84 68.92 69.17 T:tinyjambu192v2 73.35 73.55 73.89 T:tinyjambu256v2 94.54 94.68 95.41 T:isapa128av20 113.88 114.22 114.52 romulust 173.43 174.81 176.34 T:elephant200v2 218.76 219.63 220.99 T:isapk128av20 361.77 363.57 366.21 T:isapa128v20 1407.63 1408.69 1409.14 T:isapk128v20 2447.06 2488.80 2491.79 T:isapxv20 6731.51 6732.88 6735.95 T:elephant176v2 8874.82 8878.34 8881.22 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 7.19 7.19 7.20 T:aes128gcmv1 7.89 7.91 7.95 aes256gcmv1 11.41 11.47 11.80 ascon128av12 14.31 14.34 14.59 ascon128v12 14.71 14.84 14.96 ascon80pqv12 19.41 19.62 20.10 T:xoodyakround3 22.00 22.20 22.53 ascon128abi32v12 28.78 28.86 28.94 ascon128bi32v12 31.81 31.91 32.16 T:schwaemm256128v2 36.11 36.41 36.70 T:schwaemm128128v2 37.60 37.66 37.72 T:grain128aeadv2 38.66 38.74 38.89 romulusn 38.85 38.93 39.16 T:schwaemm256256v2 41.70 41.92 42.17 T:schwaemm192192v2 50.10 50.23 50.83 T:giftcofb128v1 53.64 53.84 54.09 romulusm 60.16 60.27 60.55 T:tinyjambu128v2 68.80 68.90 69.08 T:tinyjambu192v2 73.41 73.58 73.77 T:tinyjambu256v2 94.49 94.67 95.11 T:isapa128av20 113.84 113.98 114.45 romulust 172.86 174.15 174.66 T:elephant200v2 218.80 219.33 220.42 T:isapk128av20 360.76 365.56 367.05 T:isapa128v20 1407.57 1409.30 1411.45 T:isapk128v20 2445.38 2484.84 2495.77 T:isapxv20 6731.45 6733.52 6734.82 T:elephant176v2 8878.78 8882.74 8908.55 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 7.12 7.16 7.20 T:aes128gcmv1 7.85 7.86 7.89 aes256gcmv1 11.36 11.41 11.50 ascon128av12 14.28 14.31 14.47 ascon128v12 14.66 14.74 14.84 ascon80pqv12 19.51 19.62 19.84 T:xoodyakround3 21.98 22.05 22.28 ascon128abi32v12 28.76 28.82 29.07 ascon128bi32v12 31.80 31.90 32.03 T:schwaemm256128v2 36.10 36.23 36.52 T:schwaemm128128v2 37.61 37.66 37.70 T:grain128aeadv2 38.67 38.77 38.88 romulusn 38.73 38.92 39.03 T:schwaemm256256v2 41.52 41.84 42.05 T:schwaemm192192v2 50.14 50.31 50.45 T:giftcofb128v1 53.62 53.77 53.87 romulusm 60.05 60.15 60.28 T:tinyjambu128v2 62.05 62.35 62.62 T:isapa128av20 68.77 68.81 68.91 T:tinyjambu192v2 71.62 71.77 72.34 romulust 73.43 73.46 73.57 T:tinyjambu256v2 137.80 138.59 139.77 T:isapk128av20 173.07 173.96 175.23 T:elephant200v2 188.52 193.13 194.39 T:isapa128v20 736.88 738.35 738.66 T:isapk128v20 1279.89 1299.45 1299.83 T:isapxv20 6732.03 6733.02 6735.86 T:elephant176v2 8880.95 8883.25 8908.11 T:elephant160v2