VAMPIRE

eBACS: ECRYPT Benchmarking of Cryptographic Systems


ECRYPT II
General information:IntroductioneBASHeBASCeBAEADeBATSSUPERCOPXBXComputersArch
How to submit new software:Tipshashstreamaeaddhkemencryptsign
List of primitives measured:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
Measurements:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
List of subroutines:verifydecodeencodesortcorehashblocksxofscalarmult

Measurements of public-key Diffie–Hellman secret-sharing systems on one machine: amd64; Zen 4 (a60f12); 2023 AMD Ryzen 7 7700; 8 x 3800MHz; hertz, supercop-20260330

[Page version: 20260412 01:54:49]

eBATS (ECRYPT Benchmarking of Asymmetric Systems) is a project to measure the performance of public-key systems. This page presents benchmark results collected in eBATS for public-key Diffie–Hellman secret-sharing systems:

Each table row lists the first quartile of many speed measurements (or StQ1 starting with supercop-20260214), the median of many speed measurements (or StQ2 starting with supercop-20260214), the third quartile of many speed measurements (or StQ3 starting with supercop-20260214), and the name of the primitive. Measurements with large interquartile range (or stabilized interquartile range) are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each Diffie–Hellman system and each implementation. Designers and implementors interested in submitting new Diffie–Hellman systems and new implementations of existing systems should read the call for submissions.


Test results

Graphs: (pkcycles,pkbytes) (scycles,pkbytes)

Cycles to generate a key pair
25%50%75%system
242542543126822
T:
jacfp127i
264242649326507curve25519
264652804629283
T:
kumjacfp127g
272582844529812
T:
prjfp127i
278252897830089
T:
hecfp127i
308263103031661
T:
gls254
313623148731586
T:
gls254prot
305193154332855
T:
jacfp128bk
307033214335299
T:
ecfp256e
342833546039714
T:
curve2251
351783641137918
T:
prjfp128bk
364003753938807
T:
hecfp128i
362993757538867
T:
hecfp128bk
368883825239749
T:
hecfp128fkt
359963846043994
T:
ecfp256s
374023993045888
T:
ecfp256q
404844067641147nistp256
423994242542451
T:
kummer
427144279942883
T:
k277taa
483454845349463
T:
k298
610666131661384
T:
k277mon
792027930879446
T:
kumfp127g
104185104251104331
T:
kumfp128g
143995144902145776
T:
ecfp256i
162307163047164072
T:
ed448goldilocks
162807163782164816
T:
ecfp256h
208460210987213322
T:
sclaus1024
776647779509782106
T:
ed521gs
938771940255942174
T:
nist521gs
101415210184791024047
T:
claus
109320811010081110180
T:
sclaus2048
Cycles to compute a shared secret
25%50%75%system
295572962829676
T:
gls254
312663132131532
T:
gls254prot
423944243742459
T:
kummer
427424279842812
T:
k277taa
481884826948346
T:
k298
610026132561359
T:
k277mon
787857887878982
T:
jacfp128bk
815528162181704
T:
kumfp127g
825598268082745
T:
kumjacfp127g
878928789687918curve25519
938069395994104
T:
prjfp128bk
973929751897680
T:
hecfp128fkt
988049899699223
T:
hecfp128bk
108976108994109040
T:
kumfp128g
120907120977121062
T:
jacfp127i
128697128810129012
T:
ecfp256e
136792136858136939
T:
curve2251
137392137531137772
T:
ecfp256i
140831140905141052
T:
ecfp256q
150253150349150510
T:
prjfp127i
153091153174153297
T:
hecfp127i
155125155145155351
T:
ecfp256h
155452155484155590nistp256
197975198299198391
T:
ecfp256s
210521211008211211
T:
hecfp128i
215240218851220125
T:
sclaus1024
542282546063547776
T:
ed448goldilocks
775410778001780933
T:
ed521gs
938087940220942042
T:
nist521gs
101165310130971015810
T:
claus
110339411146691120160
T:
sclaus2048