VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: aarch64; Cortex-A76 (414fd0b1); 2023 Broadcom BCM2712; 4 x 1500MHz; pi5, supercop-20250415

[Page version: 20251103 11:56:58]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 2.96 2.96 2.96 T:aes128gcmv1 5.29 5.31 5.32 ascon128av12 7.80 7.82 7.84 ascon128v12 7.80 7.82 7.84 ascon80pqv12 12.00 12.10 12.19 ascon128abi32v12 15.84 15.87 15.91 T:xoodyakround3 17.12 17.22 17.30 ascon128bi32v12 22.79 22.88 23.09 T:schwaemm256128v2 30.57 30.65 30.77 T:schwaemm256256v2 30.68 30.71 30.76 T:schwaemm192192v2 31.23 31.27 31.31 T:isapa128av20 32.98 33.04 33.13 T:schwaemm128128v2 34.79 34.87 34.96 T:isapa128v20 38.39 38.42 38.47 T:giftcofb128v1 50.51 50.55 50.63 T:tinyjambu128v2 56.43 56.46 56.51 romulusn 60.64 60.67 60.70 T:tinyjambu192v2 68.19 68.22 68.25 T:tinyjambu256v2 84.63 84.71 84.89 romulusm 86.13 86.23 86.30 T:isapk128av20 114.43 114.53 114.62 T:isapk128v20 161.08 161.22 161.44 T:elephant200v2 166.54 166.60 166.63 T!!!romulust 175.40 175.55 176.16 T:isapxv20 6678.23 6679.33 6681.02 T:elephant176v2 7636.31 7637.36 7639.36 T:elephant160v2 24253.62 24259.55 24268.44 aes256gcmv1

Cycles/byte for long+0 decrypt 25% 50% 75% aead 2.96 2.96 2.96 T:aes128gcmv1 5.23 5.24 5.25 ascon128av12 7.65 7.66 7.68 ascon128v12 7.65 7.66 7.67 ascon80pqv12 11.37 11.40 11.42 ascon128abi32v12 15.53 15.56 15.65 T:xoodyakround3 16.54 16.58 16.62 ascon128bi32v12 22.98 23.04 23.09 T:schwaemm256128v2 30.58 30.72 30.95 T:schwaemm256256v2 30.90 31.02 31.17 T:schwaemm192192v2 31.20 31.26 31.33 T:isapa128av20 33.10 33.15 33.32 T:schwaemm128128v2 34.79 34.87 34.96 T:isapa128v20 38.37 38.41 38.44 T:giftcofb128v1 50.62 50.69 50.77 T:tinyjambu128v2 56.78 56.84 56.88 romulusn 60.52 60.57 60.70 T:tinyjambu192v2 68.20 68.25 68.27 T:tinyjambu256v2 85.00 85.34 85.58 romulusm 86.15 86.23 86.31 T:isapk128av20 114.40 114.58 114.74 T:isapk128v20 161.17 161.40 161.60 T:elephant200v2 166.50 166.58 166.65 T!!!romulust 173.37 176.01 178.27 T:isapxv20 6678.16 6679.77 6680.57 T:elephant176v2 7622.12 7623.22 7638.88 T:elephant160v2 24253.62 24253.62 24259.55 aes256gcmv1

Cycles/byte for long+0 forgery 25% 50% 75% aead 2.96 2.96 2.96 T:aes128gcmv1 5.23 5.25 5.26 ascon128av12 7.64 7.65 7.67 ascon128v12 7.63 7.65 7.67 ascon80pqv12 11.39 11.41 11.42 ascon128abi32v12 15.55 15.60 15.64 T:xoodyakround3 16.39 16.44 16.48 T:isapa128v20 16.65 16.89 16.90 ascon128bi32v12 20.79 20.84 20.89 T:isapa128av20 23.01 23.07 23.16 T:schwaemm256128v2 30.76 30.94 31.02 T:schwaemm256256v2 31.02 31.08 31.16 T:schwaemm192192v2 33.17 33.23 33.29 T:schwaemm128128v2 38.36 38.40 38.46 T:giftcofb128v1 50.63 50.66 50.73 T:tinyjambu128v2 56.06 56.23 56.28 T!!!romulust 56.75 56.82 56.88 romulusn 57.45 57.53 57.59 T:isapk128av20 60.52 60.55 60.72 T:tinyjambu192v2 68.19 68.24 68.27 T:tinyjambu256v2 71.91 72.03 72.08 T:isapk128v20 84.99 85.03 85.07 romulusm 102.88 103.45 103.67 T:isapxv20 161.01 161.09 161.21 T:elephant200v2 447.49 450.46 450.46 aes256gcmv1 6678.29 6680.79 6681.38 T:elephant176v2 7623.56 7640.70 7652.39 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 1.48? 2.96? 2.96? T:aes128gcmv1 5.29 5.31 5.32 ascon128av12 7.79 7.80 7.82 ascon128v12 7.78 7.81 7.83 ascon80pqv12 11.60 11.65 11.70 ascon128abi32v12 12.08 12.10 12.12 T:xoodyakround3 16.94 16.98 17.01 ascon128bi32v12 22.72 22.76 22.84 T:schwaemm256128v2 25.64 25.68 25.72 T:isapa128v20 26.03 26.06 26.10 T:isapa128av20 30.30 30.39 30.46 T:schwaemm192192v2 30.35 30.45 30.49 T:schwaemm256256v2 32.79 32.83 32.93 T:schwaemm128128v2 38.33 38.35 38.39 T:giftcofb128v1 42.19 42.24 42.36 romulusn 42.85 42.86 42.90 T:tinyjambu128v2 47.10 47.11 47.15 T:tinyjambu192v2 50.70 50.75 51.43 T:tinyjambu256v2 56.47 56.55 56.66 romulusm 71.76 71.84 71.98 T:isapk128av20 93.00 93.06 93.13 T:isapk128v20 111.31 111.38 111.41 T!!!romulust 120.13 120.20 120.28 T:elephant200v2 139.67 140.78 141.03 T:isapxv20 4989.49 4990.14 4990.67 T:elephant176v2 5727.13 5728.18 5729.02 T:elephant160v2 12352.04 12353.52 12356.49 aes256gcmv1

Cycles/byte for long+long decrypt 25% 50% 75% aead 1.48? 1.48? 2.96? T:aes128gcmv1 5.27 5.28 5.28 ascon128av12 7.71 7.72 7.75 ascon128v12 7.71 7.73 7.76 ascon80pqv12 11.28 11.30 11.31 ascon128abi32v12 11.91 11.93 11.96 T:xoodyakround3 16.70 16.77 16.83 ascon128bi32v12 22.75 22.81 22.88 T:schwaemm256128v2 25.65 25.69 25.73 T:isapa128v20 26.04 26.08 26.09 T:isapa128av20 30.44 30.54 30.60 T:schwaemm256256v2 30.49 30.55 30.64 T:schwaemm192192v2 32.70 32.87 32.95 T:schwaemm128128v2 38.32 38.34 38.36 T:giftcofb128v1 42.42 42.45 42.47 romulusn 42.79 42.84 42.90 T:tinyjambu128v2 47.12 47.15 47.17 T:tinyjambu192v2 50.73 50.77 51.14 T:tinyjambu256v2 56.51 56.59 56.64 romulusm 71.76 71.81 71.88 T:isapk128av20 93.02 93.09 93.16 T:isapk128v20 111.24 111.28 111.34 T!!!romulust 120.25 120.33 120.42 T:elephant200v2 139.42 139.71 139.89 T:isapxv20 4989.75 4990.73 4991.24 T:elephant176v2 5716.30 5728.50 5738.59 T:elephant160v2 12350.56 12353.52 12363.90 aes256gcmv1

Cycles/byte for long+long forgery 25% 50% 75% aead 0.00? 1.48? 2.96? T:aes128gcmv1 5.26 5.27 5.29 ascon128av12 7.71 7.73 7.74 ascon80pqv12 7.72 7.73 7.76 ascon128v12 11.29 11.30 11.35 ascon128abi32v12 11.94 11.96 11.98 T:xoodyakround3 16.47 16.49 16.54 T:isapa128v20 16.88 16.92 16.96 ascon128bi32v12 20.80 20.81 20.84 T:isapa128av20 22.73 22.79 22.84 T:schwaemm256128v2 30.40 30.49 30.55 T:schwaemm256256v2 30.48 30.57 30.66 T:schwaemm192192v2 32.73 32.88 32.99 T:schwaemm128128v2 38.33 38.35 38.38 T:giftcofb128v1 42.43 42.44 42.47 romulusn 42.85 42.89 42.92 T:tinyjambu128v2 47.12 47.14 47.18 T:tinyjambu192v2 50.73 50.77 50.97 T:tinyjambu256v2 56.09 56.12 56.15 T!!!romulust 56.51 56.54 56.57 romulusm 57.42 57.49 57.55 T:isapk128av20 71.73 71.78 71.81 T:isapk128v20 102.89 103.16 103.36 T:isapxv20 120.30 120.35 120.45 T:elephant200v2 447.49 450.46 450.46 aes256gcmv1 4989.20 4990.35 4991.91 T:elephant176v2 5716.77 5727.02 5728.66 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.00? 0.00? 2.96? T:aes128gcmv1 5.28 5.30 5.31 ascon128av12 7.75 7.77 7.79 ascon128v12 7.77 7.78 7.80 ascon80pqv12 8.30 8.35 8.36 T:xoodyakround3 11.17 11.19 11.21 ascon128abi32v12 16.47 16.51 16.56 T:isapa128v20 16.70 16.72 16.76 ascon128bi32v12 20.73 20.80 20.85 T:isapa128av20 22.50 22.55 22.64 T:schwaemm256128v2 28.07 28.12 28.28 romulusm 28.03 28.26 28.31 romulusn 29.97 30.07 30.13 T:schwaemm192192v2 30.02 30.16 30.32 T:schwaemm256256v2 32.26 32.65 32.69 T:schwaemm128128v2 33.56 33.60 33.62 T:tinyjambu192v2 33.96 34.00 34.69 T:tinyjambu256v2 34.81 35.03 35.12 T:tinyjambu128v2 38.24 38.29 38.34 T:giftcofb128v1 56.01 56.06 56.11 T!!!romulust 57.44 57.50 57.71 T:isapk128av20 71.45 71.53 71.60 T:isapk128v20 79.66 79.86 80.02 T:elephant200v2 102.68 103.42 103.89 T:isapxv20 447.49 450.46 450.46 aes256gcmv1 3301.82 3302.98 3303.56 T:elephant176v2 3809.55 3809.90 3817.24 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.00? 0.00? 2.96? T:aes128gcmv1 5.29 5.30 5.33 ascon128av12 7.76 7.78 7.79 ascon128v12 7.75 7.78 7.81 ascon80pqv12 8.30 8.33 8.36 T:xoodyakround3 11.24 11.26 11.26 ascon128abi32v12 16.48 16.55 16.61 T:isapa128v20 16.87 16.91 17.01 ascon128bi32v12 20.78 20.82 20.84 T:isapa128av20 22.48 22.64 22.77 T:schwaemm256128v2 28.07 28.12 28.23 romulusm 28.10 28.12 28.15 romulusn 29.85 29.96 30.10 T:schwaemm192192v2 30.11 30.20 30.52 T:schwaemm256256v2 32.23 32.49 32.67 T:schwaemm128128v2 33.58 33.59 33.63 T:tinyjambu192v2 33.20 33.91 34.00 T:tinyjambu256v2 35.04 35.07 35.23 T:tinyjambu128v2 38.28 38.31 38.34 T:giftcofb128v1 55.99 56.03 56.10 T!!!romulust 57.41 57.46 57.52 T:isapk128av20 71.40 71.48 71.59 T:isapk128v20 79.74 79.82 80.01 T:elephant200v2 103.11 103.53 103.65 T:isapxv20 447.49 450.46 453.42 aes256gcmv1 3301.54 3302.63 3303.55 T:elephant176v2 3808.89 3810.50 3817.38 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.00? 0.00? 2.96? T:aes128gcmv1 5.27 5.30 5.31 ascon128av12 7.75 7.77 7.81 ascon80pqv12 7.77 7.79 7.81 ascon128v12 8.32 8.34 8.37 T:xoodyakround3 11.24 11.26 11.27 ascon128abi32v12 16.51 16.56 16.59 T:isapa128v20 16.68 16.94 17.00 ascon128bi32v12 20.79 20.82 20.84 T:isapa128av20 22.58 22.62 22.73 T:schwaemm256128v2 28.10 28.12 28.14 romulusn 28.07 28.21 28.25 romulusm 29.87 29.96 30.09 T:schwaemm192192v2 30.01 30.12 30.17 T:schwaemm256256v2 32.60 32.67 32.77 T:schwaemm128128v2 33.57 33.58 33.61 T:tinyjambu192v2 33.34 33.98 34.01 T:tinyjambu256v2 35.00 35.06 35.09 T:tinyjambu128v2 38.24 38.28 38.30 T:giftcofb128v1 56.02 56.08 56.15 T!!!romulust 57.42 57.47 57.54 T:isapk128av20 71.43 71.49 71.65 T:isapk128v20 79.69 79.79 79.87 T:elephant200v2 102.53 103.60 103.82 T:isapxv20 450.46 450.46 453.42 aes256gcmv1 3301.14 3302.54 3303.67 T:elephant176v2 3809.64 3810.59 3816.77 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 1.85 1.85 1.85 T:aes128gcmv1 5.42 5.43 5.44 ascon128av12 7.91 7.92 7.93 ascon128v12 7.92 7.93 7.94 ascon80pqv12 11.86 11.89 11.90 ascon128abi32v12 12.20 12.21 12.23 T:xoodyakround3 17.26 17.27 17.32 ascon128bi32v12 23.41 23.55 23.72 T:schwaemm256128v2 27.80 27.82 27.85 T:isapa128av20 30.98 31.02 31.11 T:schwaemm192192v2 31.23 31.27 31.28 T:schwaemm256256v2 32.98 33.10 33.17 T:schwaemm128128v2 37.14 37.17 37.20 T:isapa128v20 38.64 38.66 38.69 T:giftcofb128v1 42.47 42.55 42.58 romulusn 43.15 43.18 43.20 T:tinyjambu128v2 47.46 47.48 47.50 T:tinyjambu192v2 51.16 51.45 51.47 T:tinyjambu256v2 56.73 56.75 56.82 romulusm 79.94 79.98 79.99 T:isapk128av20 112.84 112.87 112.91 T!!!romulust 122.67 122.82 122.86 T:elephant200v2 157.84 157.89 157.92 T:isapk128v20 226.20 226.28 226.36 T:isapxv20 5028.17 5029.14 5029.97 T:elephant176v2 5781.56 5782.06 5801.87 T:elephant160v2 12602.46 12604.31 12608.02 aes256gcmv1

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 1.85 1.85 1.85 T:aes128gcmv1 5.39 5.41 5.43 ascon128av12 7.82 7.84 7.86 ascon128v12 7.83 7.85 7.86 ascon80pqv12 11.58 11.60 11.62 ascon128abi32v12 12.06 12.09 12.10 T:xoodyakround3 17.00 17.11 17.21 ascon128bi32v12 23.38 23.44 23.48 T:schwaemm256128v2 27.82 27.86 27.88 T:isapa128av20 31.06 31.15 31.19 T:schwaemm192192v2 31.26 31.34 31.51 T:schwaemm256256v2 33.21 33.30 33.34 T:schwaemm128128v2 37.15 37.17 37.20 T:isapa128v20 38.64 38.65 38.68 T:giftcofb128v1 42.70 42.73 42.75 romulusn 43.12 43.17 43.23 T:tinyjambu128v2 47.49 47.50 47.51 T:tinyjambu192v2 51.39 51.46 51.49 T:tinyjambu256v2 56.84 56.86 56.88 romulusm 79.88 79.92 79.96 T:isapk128av20 112.84 112.88 112.90 T!!!romulust 122.79 122.90 122.97 T:elephant200v2 157.89 157.94 159.57 T:isapk128v20 226.12 226.30 226.45 T:isapxv20 5027.51 5028.53 5029.42 T:elephant176v2 5781.84 5788.02 5791.75 T:elephant160v2 12602.46 12602.46 12604.31 aes256gcmv1

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 1.85 1.85 1.85 T:aes128gcmv1 5.39 5.40 5.41 ascon128av12 7.82 7.84 7.86 ascon128v12 7.84 7.85 7.87 ascon80pqv12 11.57 11.58 11.59 ascon128abi32v12 12.10 12.11 12.12 T:xoodyakround3 17.06 17.07 17.20 ascon128bi32v12 21.83 21.84 21.86 T:isapa128av20 22.31 22.32 22.35 T:isapa128v20 23.39 23.47 23.52 T:schwaemm256128v2 31.16 31.21 31.25 T:schwaemm192192v2 31.28 31.35 31.43 T:schwaemm256256v2 33.14 33.23 33.36 T:schwaemm128128v2 38.63 38.64 38.66 T:giftcofb128v1 42.68 42.72 42.76 romulusn 43.14 43.19 43.24 T:tinyjambu128v2 47.47 47.48 47.50 T:tinyjambu192v2 51.31 51.44 51.47 T:tinyjambu256v2 56.84 56.86 56.91 romulusm 57.67 57.68 57.71 T!!!romulust 62.17 62.21 62.24 T:isapk128av20 105.01 105.04 105.07 T:isapk128v20 122.67 122.82 122.90 T:elephant200v2 147.52 147.66 147.74 T:isapxv20 700.14 700.14 701.99 aes256gcmv1 5027.96 5028.84 5029.69 T:elephant176v2 5782.08 5791.72 5792.60 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 0.00? 0.00? 44.45? T:aes128gcmv1 8.34 8.41 8.69 ascon128av12 10.62 10.71 10.86 ascon128v12 10.58 10.74 10.85 ascon80pqv12 17.91 18.02 18.24 ascon128abi32v12 18.03 18.26 18.41 T:xoodyakround3 23.52 23.57 23.88 ascon128bi32v12 37.38 37.52 37.71 T:schwaemm256128v2 42.30 42.53 42.70 T:schwaemm128128v2 45.46 45.59 45.66 T:giftcofb128v1 49.27 49.33 49.40 T:schwaemm256256v2 49.08 49.41 49.53 T:schwaemm192192v2 49.52 49.61 49.68 romulusn 50.55 50.66 50.73 T:tinyjambu128v2 55.30 55.37 55.59 T:tinyjambu192v2 59.72 59.84 59.98 T:tinyjambu256v2 63.91 64.02 64.07 romulusm 68.15 68.40 68.66 T:isapa128av20 147.88 148.00 148.30 T!!!romulust 173.27 173.66 174.16 T:elephant200v2 250.84 251.26 251.72 T:isapk128av20 300.59 301.09 301.57 T:isapa128v20 1630.12 1630.64 1630.91 T:isapk128v20 2195.44 2197.58 2199.85 T:isapxv20 6263.12 6264.78 6266.74 T:elephant176v2 7742.21 7746.73 7755.12 T:elephant160v2 18314.69 18359.14 18359.14 aes256gcmv1

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 0.00? 0.00? 44.45? T:aes128gcmv1 8.48 8.59 8.72 ascon128av12 10.45 10.54 10.74 ascon128v12 10.73 10.77 10.85 ascon80pqv12 17.73 17.79 17.99 T:xoodyakround3 18.05 18.12 18.38 ascon128abi32v12 23.65 23.79 23.99 ascon128bi32v12 37.22 37.42 37.54 T:schwaemm256128v2 42.28 42.44 42.57 T:schwaemm128128v2 45.47 45.54 45.68 T:giftcofb128v1 49.20 49.24 49.34 T:schwaemm256256v2 49.25 49.46 49.57 T:schwaemm192192v2 49.67 49.75 49.80 romulusn 50.33 50.51 50.57 T:tinyjambu128v2 55.31 55.43 55.69 T:tinyjambu192v2 59.70 59.85 59.90 T:tinyjambu256v2 64.14 64.20 64.30 romulusm 68.10 68.48 68.75 T:isapa128av20 148.27 148.54 148.80 T!!!romulust 173.09 173.37 174.10 T:elephant200v2 251.54 251.80 252.13 T:isapk128av20 300.87 301.39 301.87 T:isapa128v20 1630.07 1630.59 1631.34 T:isapk128v20 2166.30 2195.72 2196.77 T:isapxv20 6257.80 6262.39 6264.40 T:elephant176v2 7741.75 7746.68 7753.56 T:elephant160v2 18359.14 18359.14 18359.14 aes256gcmv1

Cycles/byte for 64+64 forgery 25% 50% 75% aead 0.00? 0.00? 44.45? T:aes128gcmv1 8.23 8.34 8.41 ascon128av12 10.35 10.39 10.43 ascon128v12 10.58 10.65 10.71 ascon80pqv12 17.82 17.87 18.13 T:xoodyakround3 18.03 18.09 18.15 ascon128abi32v12 23.55 23.59 23.67 ascon128bi32v12 37.27 37.45 37.68 T:schwaemm256128v2 42.31 42.41 42.57 T:schwaemm128128v2 44.58 44.73 44.85 T:isapa128av20 45.43 45.57 45.71 T:giftcofb128v1 49.14 49.26 49.29 T:schwaemm256256v2 49.27 49.43 49.60 T:schwaemm192192v2 49.70 49.81 49.88 romulusn 50.48 50.55 50.63 T:tinyjambu128v2 55.24 55.32 55.38 T:tinyjambu192v2 59.61 59.78 60.06 T:tinyjambu256v2 64.05 64.23 64.38 romulusm 92.83 93.14 93.45 T!!!romulust 156.62 157.10 157.34 T:isapa128v20 158.38 158.66 158.98 T:isapk128av20 173.06 173.35 173.62 T:elephant200v2 855.41 855.65 856.29 T:isapk128v20 1141.59 1149.68 1151.19 T:isapxv20 6260.20 6263.68 6267.08 T:elephant176v2 6445.70 6445.70 6445.70 aes256gcmv1 7743.15 7755.24 7769.69 T:elephant160v2