VAMPIRE

eBACS: ECRYPT Benchmarking of Cryptographic Systems


ECRYPT II
General information:IntroductioneBASHeBASCeBAEADeBATSSUPERCOPXBXComputersArch
How to submit new software:Tipshashstreamaeaddhkemencryptsign
List of primitives measured:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
Measurements:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
List of subroutines:verifydecodeencodesortcorehashblocksxofscalarmult

Measurements of NISTLWC cipher candidates on one machine: amd64; Broadwell+AES (406f1); 2016 Intel Xeon E5-2609 v4; 8 x 1700MHz; bolero, supercop-20240909

[Page version: 20240912 11:46:31]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.


Test results

Graphs: (bytes,cycles)
Cycles/byte for long+0 encrypt
25%50%75%aead
0.70?0.76?0.83?T:aes128gcmv1
0.26?1.07?1.33?T:aes256gcmv1
6.86?7.16?10.42?ascon128av12
10.5410.5610.59ascon128v12
10.6010.7110.77ascon80pqv12
14.3014.3514.56ascon128abi32v12
17.0417.0917.15T:xoodyakround3
18.6318.6718.70T:schwaemm256128v2
21.69?21.78?24.86?ascon128bi32v12
23.4923.5423.86T:schwaemm256256v2
24.5724.6324.69T:schwaemm192192v2
25.1925.2125.24T:grain128aeadv2
27.1527.2027.24T:schwaemm128128v2
39.1639.2139.26romulusn
39.9540.7141.54T:isapa128v20
41.4141.4941.66T:isapa128av20
41.6441.6741.69T:giftcofb128v1
60.8960.9460.95T:tinyjambu128v2
63.2363.5966.38romulusm
70.5170.6770.85T:isapk128av20
73.77?74.17?107.06?T:tinyjambu192v2
80.7882.3087.92T:tinyjambu256v2
92.5893.0296.31T:isapk128v20
127.04127.44127.54romulust
151.45151.59151.75T:elephant200v2
187.25187.60188.66T:isapxv20
298.70311.00330.23aes256gcmv1
7276.327465.567496.19T:elephant176v2
8530.508538.508563.75T:elephant160v2
Cycles/byte for long+0 decrypt
25%50%75%aead
0.65?0.77?0.81?T:aes128gcmv1
0.20?1.15?2.95?T:aes256gcmv1
6.91?8.87?10.40?ascon128av12
10.3510.4110.51ascon128v12
10.4910.6110.67ascon80pqv12
14.4214.4614.52ascon128abi32v12
16.8816.9717.01T:xoodyakround3
18.6418.6918.73T:schwaemm256128v2
21.5221.5721.65ascon128bi32v12
23.5423.6023.87T:schwaemm256256v2
24.5624.6724.73T:schwaemm192192v2
25.6225.6625.71T:grain128aeadv2
27.2527.2927.34T:schwaemm128128v2
39.2039.2239.28romulusn
39.3139.8140.35T:isapa128v20
41.6441.6841.71T:giftcofb128v1
41.6341.6941.74T:isapa128av20
60.9460.9761.01T:tinyjambu128v2
63.1263.2463.68romulusm
70.5570.6670.78T:isapk128av20
74.02?77.29?107.14?T:tinyjambu192v2
82.2882.2882.53T:tinyjambu256v2
91.83?93.56?102.43?T:isapk128v20
127.02127.45127.53romulust
151.50151.64151.85T:elephant200v2
186.59188.09188.52T:isapxv20
303.11314.54330.38aes256gcmv1
7273.137453.697521.71T:elephant176v2
8524.688539.968559.60T:elephant160v2
Cycles/byte for long+0 forgery
25%50%75%aead
0.57?0.77?0.80?T:aes128gcmv1
0.10?0.81?1.07?T:aes256gcmv1
6.89?8.57?10.43?ascon128av12
10.3210.3610.52ascon128v12
10.4810.5310.64ascon80pqv12
14.3714.4114.44ascon128abi32v12
16.8916.9717.05T:xoodyakround3
18.6418.6818.71T:schwaemm256128v2
19.1919.2719.83T:isapa128v20
21.54?23.37?26.16?ascon128bi32v12
23.5323.5823.88T:schwaemm256256v2
24.5824.6524.73T:schwaemm192192v2
25.6325.6825.72T:grain128aeadv2
27.2727.3227.34T:schwaemm128128v2
28.4428.4828.53T:isapa128av20
39.2039.2439.26romulusn
41.6341.6741.71T:giftcofb128v1
44.2544.3044.33romulust
46.6446.7546.94T:isapk128av20
55.7557.7860.08T:isapk128v20
60.9861.0261.04T:tinyjambu128v2
63.1463.2665.08romulusm
74.05?79.13?107.10?T:tinyjambu192v2
82.2982.3082.43T:tinyjambu256v2
110.74111.20111.74T:isapxv20
151.42151.64152.05T:elephant200v2
298.12307.70319.66aes256gcmv1
7283.487465.077500.43T:elephant176v2
8225.108536.548561.06T:elephant160v2
Cycles/byte for long+long encrypt
25%50%75%aead
0.23?0.46?0.69?T:aes256gcmv1
0.500.540.55T:aes128gcmv1
6.927.177.20ascon128av12
10.5510.5710.58ascon128v12
10.52?10.62?12.06?ascon80pqv12
13.1113.1213.15T:xoodyakround3
14.3314.3914.46ascon128abi32v12
18.5218.5418.58T:schwaemm256128v2
21.2921.5221.64ascon128bi32v12
23.3623.5323.82T:schwaemm256256v2
23.5424.4524.51T:schwaemm192192v2
25.2625.2825.30T:grain128aeadv2
27.0727.0927.20T:schwaemm128128v2
29.9030.0130.41T:isapa128v20
31.4931.5131.61romulusn
35.0035.0435.08T:isapa128av20
41.5441.5741.61T:giftcofb128v1
43.5043.5243.86romulusm
49.9750.0150.06T:tinyjambu128v2
56.1857.9658.02T:tinyjambu192v2
58.6658.7558.93T:isapk128av20
60.30?67.93?89.96?T:tinyjambu256v2
75.4275.5175.71T:isapk128v20
85.73?88.86?124.26?romulust
114.08114.21114.38T:elephant200v2
149.33149.46151.58T:isapxv20
294.95301.28307.19aes256gcmv1
5421.735433.445437.08T:elephant176v2
6398.416417.446429.04T:elephant160v2
Cycles/byte for long+long decrypt
25%50%75%aead
0.19?0.26?0.64?T:aes256gcmv1
0.47?0.50?0.53?T:aes128gcmv1
6.857.127.16ascon128av12
10.4510.4911.23ascon128v12
10.52?11.37?12.79?ascon80pqv12
13.0313.0613.08T:xoodyakround3
14.3214.3514.45ascon128abi32v12
18.5218.5618.59T:schwaemm256128v2
21.3921.4421.66ascon128bi32v12
23.3823.7325.45T:schwaemm256256v2
23.5824.4924.55T:schwaemm192192v2
25.4225.4825.51T:grain128aeadv2
27.13?27.29?31.40?T:schwaemm128128v2
29.4929.7830.01T:isapa128v20
31.5531.5731.60romulusn
35.0435.0835.12T:isapa128av20
41.5641.5941.61T:giftcofb128v1
43.5443.6143.92romulusm
50.0250.0650.10T:tinyjambu128v2
56.0257.9858.04T:tinyjambu192v2
58.6558.7258.82T:isapk128av20
60.30?63.90?89.95?T:tinyjambu256v2
75.4975.6276.97T:isapk128v20
85.68?87.15?124.24?romulust
114.00114.11114.33T:elephant200v2
149.29149.72153.39T:isapxv20
292.21301.94311.80aes256gcmv1
5423.485430.445435.54T:elephant176v2
6399.326412.456600.79T:elephant160v2
Cycles/byte for long+long forgery
25%50%75%aead
0.470.490.52T:aes128gcmv1
0.24?0.61?0.69?T:aes256gcmv1
6.877.167.18ascon128av12
10.4510.4810.50ascon128v12
10.4910.5411.37ascon80pqv12
13.0413.0713.10T:xoodyakround3
14.3014.3314.41ascon128abi32v12
18.5118.5618.61T:schwaemm256128v2
19.5219.7419.76T:isapa128v20
20.6721.4121.58ascon128bi32v12
23.3823.4124.65T:schwaemm256256v2
23.5224.5224.55T:schwaemm192192v2
25.4625.4925.52T:grain128aeadv2
27.1327.2829.45T:schwaemm128128v2
28.4228.4528.48T:isapa128av20
31.5531.5731.58romulusn
41.5741.5941.62T:giftcofb128v1
43.5443.6043.92romulusm
44.15?46.63?64.22?romulust
46.6946.7946.86T:isapk128av20
50.0350.0650.08T:tinyjambu128v2
56.1957.9958.03T:tinyjambu192v2
57.8458.0058.12T:isapk128v20
60.45?67.20?89.94?T:tinyjambu256v2
111.16111.24111.96T:isapxv20
113.93114.17114.35T:elephant200v2
288.28294.79305.50aes256gcmv1
5423.225428.245435.71T:elephant176v2
6415.446578.456610.94T:elephant160v2
Cycles/byte for 0+long encrypt
25%50%75%aead
-1.53?0.17?0.31?T:aes256gcmv1
0.26?0.30?0.36?T:aes128gcmv1
6.887.197.21ascon128av12
9.119.149.17T:xoodyakround3
10.5110.5510.57ascon128v12
10.44?12.05?13.42?ascon80pqv12
14.38?17.46?20.91?ascon128abi32v12
18.3518.3718.44T:schwaemm256128v2
19.1819.6120.27T:isapa128v20
21.2621.3422.87ascon128bi32v12
23.1923.2223.52T:schwaemm256256v2
23.8223.8523.86romulusn
23.8023.8824.18romulusm
23.2524.2824.37T:schwaemm192192v2
25.2125.2625.28T:grain128aeadv2
26.9226.9626.99T:schwaemm128128v2
28.4328.4628.49T:isapa128av20
39.0839.1539.17T:tinyjambu128v2
41.3941.4341.46T:giftcofb128v1
42.0342.0742.12T:tinyjambu192v2
42.0642.0842.19T:tinyjambu256v2
44.0544.1044.12romulust
46.7246.9247.06T:isapk128av20
57.9658.1958.69T:isapk128v20
76.8176.9177.08T:elephant200v2
111.16111.29111.46T:isapxv20
301.22309.48316.55aes256gcmv1
3586.523596.393601.80T:elephant176v2
4271.704285.784396.54T:elephant160v2
Cycles/byte for 0+long decrypt
25%50%75%aead
0.23?0.27?0.32?T:aes128gcmv1
0.14?0.54?2.01?T:aes256gcmv1
6.807.147.16ascon128av12
9.089.119.18T:xoodyakround3
10.3910.4210.46ascon128v12
10.42?10.50?12.08?ascon80pqv12
14.32?14.35?20.93?ascon128abi32v12
18.3418.3618.39T:schwaemm256128v2
19.2019.5820.28T:isapa128v20
21.2221.2521.33ascon128bi32v12
23.1623.2223.47T:schwaemm256256v2
23.8523.8823.89romulusn
23.8423.9124.26romulusm
23.2924.3124.38T:schwaemm192192v2
25.2025.2425.29T:grain128aeadv2
26.9026.9626.99T:schwaemm128128v2
28.3828.4428.48T:isapa128av20
39.1139.1739.22T:tinyjambu128v2
41.4241.4641.49T:giftcofb128v1
42.0742.0845.60T:tinyjambu256v2
42.08?42.18?48.16?T:tinyjambu192v2
44.0344.1044.16romulust
46.7346.8546.95T:isapk128av20
57.8858.0961.68T:isapk128v20
76.9277.1077.27T:elephant200v2
110.81111.62111.69T:isapxv20
295.94313.80324.61aes256gcmv1
3582.893596.563600.10T:elephant176v2
4283.744390.364422.03T:elephant160v2
Cycles/byte for 0+long forgery
25%50%75%aead
0.24?0.29?0.34?T:aes128gcmv1
0.04?0.33?0.94?T:aes256gcmv1
6.807.137.16ascon128av12
9.089.109.16T:xoodyakround3
10.41?10.44?11.87?ascon128v12
10.45?11.97?12.24?ascon80pqv12
14.35?14.40?20.92?ascon128abi32v12
18.3618.3818.45T:schwaemm256128v2
19.2319.7020.25T:isapa128v20
21.27?21.73?24.36?ascon128bi32v12
23.2223.2423.51T:schwaemm256256v2
23.8223.8624.22romulusm
23.8523.8723.89romulusn
23.2124.2924.37T:schwaemm192192v2
25.2125.2525.28T:grain128aeadv2
26.9426.9626.99T:schwaemm128128v2
28.4228.4728.50T:isapa128av20
39.0839.1439.17T:tinyjambu128v2
41.4341.4941.52T:giftcofb128v1
42.0042.0342.12T:tinyjambu192v2
42.0742.0842.08T:tinyjambu256v2
44.0144.0644.13romulust
46.8146.8746.99T:isapk128av20
57.8758.0958.27T:isapk128v20
76.9377.0077.15T:elephant200v2
110.83111.32111.89T:isapxv20
286.58?303.44?320.94?aes256gcmv1
3586.043596.093602.04T:elephant176v2
4265.734271.604282.20T:elephant160v2
Cycles/byte for 1536+1536 encrypt
25%50%75%aead
1.711.711.72T:aes128gcmv1
1.881.881.89T:aes256gcmv1
7.347.357.38ascon128av12
10.7010.7110.72ascon128v12
10.6510.7210.77ascon80pqv12
13.2513.2613.28T:xoodyakround3
14.6814.7715.73ascon128abi32v12
19.0319.0619.10T:schwaemm256128v2
21.8122.0222.83ascon128bi32v12
24.0024.0324.31T:schwaemm256256v2
25.0025.0225.05T:schwaemm192192v2
25.6725.6925.72T:grain128aeadv2
27.4227.4427.53T:schwaemm128128v2
31.7631.8131.85romulusn
37.5537.5937.62T:isapa128av20
41.9241.9541.98T:giftcofb128v1
43.7943.8544.13romulusm
43.8243.9144.11T:isapa128v20
50.4050.4150.44T:tinyjambu128v2
58.3958.4258.48T:tinyjambu192v2
62.6562.6562.67T:tinyjambu256v2
65.7665.8165.97T:isapk128av20
86.8287.0487.11romulust
116.47116.58116.79T:elephant200v2
130.38130.54130.65T:isapk128v20
245.03245.12248.04T:isapxv20
304.20309.02315.96aes256gcmv1
5464.855468.455474.37T:elephant176v2
6472.886484.796492.90T:elephant160v2
Cycles/byte for 1536+1536 decrypt
25%50%75%aead
1.681.691.73T:aes128gcmv1
1.871.871.91T:aes256gcmv1
7.32?7.35?8.20?ascon128av12
10.6110.6511.68ascon128v12
10.6510.6710.86ascon80pqv12
13.1713.1813.20T:xoodyakround3
14.6314.6614.71ascon128abi32v12
19.0719.0919.11T:schwaemm256128v2
21.72?22.02?24.95?ascon128bi32v12
24.0224.2824.35T:schwaemm256256v2
25.0125.0625.12T:schwaemm192192v2
25.8425.8825.91T:grain128aeadv2
27.4527.4927.51T:schwaemm128128v2
31.8431.8531.86romulusn
37.5837.6337.65T:isapa128av20
41.9341.9541.99T:giftcofb128v1
43.7043.8844.11T:isapa128v20
43.8943.9944.30romulusm
50.4050.4450.53T:tinyjambu128v2
58.4158.4858.51T:tinyjambu192v2
62.6362.6362.63T:tinyjambu256v2
65.8365.9165.95T:isapk128av20
86.8587.0487.07romulust
116.47116.65116.92T:elephant200v2
130.40130.54130.65T:isapk128v20
244.90245.34247.34T:isapxv20
300.11312.27324.71aes256gcmv1
5464.305467.395476.72T:elephant176v2
6473.416475.746491.87T:elephant160v2
Cycles/byte for 1536+1536 forgery
25%50%75%aead
1.681.701.72T:aes128gcmv1
1.861.871.91T:aes256gcmv1
7.30?7.34?8.26?ascon128av12
10.6110.6311.63ascon128v12
10.6510.6710.72ascon80pqv12
13.1513.1813.21T:xoodyakround3
14.6214.6414.71ascon128abi32v12
19.0819.0919.11T:schwaemm256128v2
21.7221.7421.88ascon128bi32v12
24.0424.2724.33T:schwaemm256256v2
25.0325.0625.09T:schwaemm192192v2
25.8425.8625.88T:grain128aeadv2
26.6526.8626.92T:isapa128v20
27.4527.4827.52T:schwaemm128128v2
29.8629.8929.92T:isapa128av20
31.8231.8431.90romulusn
41.9241.9241.97T:giftcofb128v1
43.8943.9844.24romulusm
45.4445.4545.48romulust
50.4550.4850.58T:tinyjambu128v2
50.8750.9352.22T:isapk128av20
58.3958.4558.52T:tinyjambu192v2
62.6362.6462.79T:tinyjambu256v2
86.2186.2986.39T:isapk128v20
116.49116.57116.86T:elephant200v2
160.21160.41162.20T:isapxv20
293.35?317.17?432.39?aes256gcmv1
5465.345477.255620.71T:elephant176v2
6473.856476.286492.31T:elephant160v2
Cycles/byte for 64+64 encrypt
25%50%75%aead
11.09?11.31?15.71?ascon128av12
14.0014.0614.31ascon128v12
14.0914.2214.56ascon80pqv12
19.0319.2819.69T:xoodyakround3
21.72?22.28?30.55?ascon128abi32v12
28.5028.6629.25ascon128bi32v12
29.3429.6230.03T:aes128gcmv1
30.7831.1931.38T:schwaemm256128v2
34.4734.5334.75T:grain128aeadv2
34.88?35.34?48.91?T:schwaemm128128v2
30.78?36.09?43.56?T:aes256gcmv1
37.9138.0338.22romulusn
38.1638.2838.59T:schwaemm256256v2
39.9740.3840.72T:schwaemm192192v2
49.8450.0050.22T:giftcofb128v1
50.2850.4450.78romulusm
59.4459.6259.72T:tinyjambu128v2
68.38?68.81?96.78?T:tinyjambu192v2
73.1273.4773.72T:tinyjambu256v2
95.1995.5695.81T:isapa128av20
116.97117.59118.41romulust
165.44165.84166.66T:elephant200v2
212.34213.06214.03T:isapk128av20
323.78?349.44?379.28?aes256gcmv1
359.22361.78362.81T:isapa128v20
1371.781372.691373.84T:isapk128v20
2418.312419.192545.72T:isapxv20
6787.286807.066812.41T:elephant176v2
8652.818657.508684.50T:elephant160v2
Cycles/byte for 64+64 decrypt
25%50%75%aead
11.19?11.28?15.88?ascon128av12
13.9114.0314.31ascon128v12
14.1614.2814.62ascon80pqv12
19.0019.1619.72T:xoodyakround3
21.78?22.28?30.98?ascon128abi32v12
28.5628.6929.09ascon128bi32v12
29.0629.4129.91T:aes128gcmv1
30.7830.9431.72T:schwaemm256128v2
30.00?34.81?42.46?T:aes256gcmv1
34.8134.8434.97T:grain128aeadv2
34.94?35.16?49.35?T:schwaemm128128v2
38.1238.1938.31romulusn
38.1938.3838.72T:schwaemm256256v2
40.0940.6240.84T:schwaemm192192v2
50.0050.0950.25T:giftcofb128v1
51.6251.9752.12romulusm
59.3859.5059.72T:tinyjambu128v2
68.38?68.50?96.82?T:tinyjambu192v2
73.1673.3473.38T:tinyjambu256v2
94.9195.3195.81T:isapa128av20
117.28117.50117.84romulust
165.16165.38165.78T:elephant200v2
213.03213.97215.00T:isapk128av20
323.06?343.97?374.44?aes256gcmv1
362.50369.47370.44T:isapa128v20
1372.881373.691415.50T:isapk128v20
2412.382418.782424.06T:isapxv20
6785.066807.066813.16T:elephant176v2
8653.978674.628697.78T:elephant160v2
Cycles/byte for 64+64 forgery
25%50%75%aead
11.06?11.19?15.73?ascon128av12
13.8413.9114.16ascon128v12
14.1214.2814.41ascon80pqv12
19.0919.1619.56T:xoodyakround3
21.66?21.88?30.55?ascon128abi32v12
28.4128.5928.78ascon128bi32v12
28.7828.8429.00T:aes128gcmv1
29.66?30.31?42.14?T:aes256gcmv1
30.6630.7831.19T:schwaemm256128v2
34.8434.9134.94T:grain128aeadv2
34.72?35.12?49.27?T:schwaemm128128v2
38.0938.1638.31romulusn
38.0938.2838.44T:schwaemm256256v2
40.0640.5940.81T:schwaemm192192v2
49.8849.9450.03T:giftcofb128v1
51.5051.7552.16romulusm
59.2859.3459.59T:tinyjambu128v2
62.3162.5662.72T:isapa128av20
68.31?68.38?96.73?T:tinyjambu192v2
73.1973.2273.28T:tinyjambu256v2
74.5074.6675.03romulust
133.72134.00134.50T:isapk128av20
164.97165.16166.09T:elephant200v2
186.41192.47192.91T:isapa128v20
316.12?338.16?382.19?aes256gcmv1
719.12721.16722.53T:isapk128v20
1262.531267.531268.94T:isapxv20
6787.786817.416844.56T:elephant176v2
8655.038662.918682.94T:elephant160v2