VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: amd64; Broadwell+AES (406f1); 2016 Intel Xeon E5-2609 v4; 8 x 1700MHz; bolero, supercop-20250922

[Page version: 20251103 11:56:58]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 1.26 1.29 1.29 T:aes128gcmv1 1.89 2.05 2.07 aes256gcmv1 7.16 7.19 7.23 ascon128av12 10.56 10.58 10.62 ascon128v12 10.24 10.59 10.64 ascon80pqv12 14.30? 14.35? 16.63? ascon128abi32v12 17.07 17.11 17.17 T:xoodyakround3 17.87 18.70 18.74 T:schwaemm256128v2 23.53 23.57 23.82 T:schwaemm256256v2 21.17? 23.92? 25.28? ascon128bi32v12 24.59 24.66 24.77 T:schwaemm192192v2 25.22 25.25 25.28 T:grain128aeadv2 27.14 27.23 27.43 T:schwaemm128128v2 38.34 38.38 38.40 romulusn 39.83 40.33 40.65 T:isapa128v20 41.56 41.64 41.71 T:isapa128av20 41.63 41.66 41.69 T:giftcofb128v1 61.06 61.11 61.14 T:tinyjambu128v2 62.30 62.39 65.87 romulusm 70.08 70.31 70.52 T:isapk128av20 73.14 75.37 78.34 T:tinyjambu192v2 79.72 82.32 82.34 T:tinyjambu256v2 90.74 92.88 93.14 T:isapk128v20 121.36 123.99 125.92 romulust 151.42 151.57 152.34 T:elephant200v2 187.34 187.87 187.92 T:isapxv20 7266.28 7272.07 7281.37 T:elephant176v2 8540.05 8561.02 8565.77 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 1.47 1.50 1.52 T:aes128gcmv1 1.97 2.14 2.18 aes256gcmv1 7.10 7.13 7.15 ascon128av12 10.32 10.39 10.52 ascon128v12 10.14 10.62 10.68 ascon80pqv12 14.41? 14.46? 18.23? ascon128abi32v12 16.84 16.91 17.01 T:xoodyakround3 17.88 18.69 18.75 T:schwaemm256128v2 21.19? 21.39? 25.60? ascon128bi32v12 23.51 23.56 23.80 T:schwaemm256256v2 24.56 24.62 24.70 T:schwaemm192192v2 25.65 25.68 25.71 T:grain128aeadv2 27.26 27.30 27.35 T:schwaemm128128v2 38.36 38.41 38.44 romulusn 39.61 40.25 40.69 T:isapa128v20 41.52 41.64 41.70 T:isapa128av20 41.64 41.67 41.70 T:giftcofb128v1 61.09 61.18 61.24 T:tinyjambu128v2 62.35 62.42 62.50 romulusm 69.97 70.10 70.55 T:isapk128av20 72.50 74.10 77.26 T:tinyjambu192v2 79.70 82.31 82.32 T:tinyjambu256v2 92.64 92.88 93.14 T:isapk128v20 121.38 125.78 126.02 romulust 151.56 151.76 155.04 T:elephant200v2 187.47 187.86 188.22 T:isapxv20 7260.36 7268.71 7278.01 T:elephant176v2 8538.64 8558.14 8563.51 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 1.49 1.50 1.51 T:aes128gcmv1 1.97 2.13 2.16 aes256gcmv1 7.12 7.14 7.17 ascon128av12 10.11 10.51 10.62 ascon80pqv12 10.37 10.51 10.56 ascon128v12 16.88 16.94 17.05 T:xoodyakround3 14.48? 17.50? 20.59? ascon128abi32v12 17.90? 18.71? 20.29? T:schwaemm256128v2 20.13 20.35 20.41 T:isapa128v20 21.18? 21.20? 24.39? ascon128bi32v12 23.52 23.55 23.81 T:schwaemm256256v2 24.59 24.62 24.67 T:schwaemm192192v2 25.55 25.69 25.73 T:grain128aeadv2 27.25 27.29 27.33 T:schwaemm128128v2 28.42 28.46 28.50 T:isapa128av20 38.37 38.40 38.43 romulusn 41.64 41.68 41.71 T:giftcofb128v1 41.04 43.06 43.25 romulust 46.29 46.37 46.50 T:isapk128av20 57.61 57.88 58.11 T:isapk128v20 61.13 61.17 61.22 T:tinyjambu128v2 62.38 62.42 62.45 romulusm 74.12 74.29 78.11 T:tinyjambu192v2 79.66 82.30 82.52 T:tinyjambu256v2 110.99 111.28 111.66 T:isapxv20 151.46 151.54 152.31 T:elephant200v2 7266.47 7273.34 7279.02 T:elephant176v2 8533.58 8560.14 8565.26 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.84 0.86 0.87 T:aes128gcmv1 1.20 1.22 1.24 aes256gcmv1 7.12 7.14 7.16 ascon128av12 10.54 10.57 11.28 ascon128v12 10.54? 11.37? 12.14? ascon80pqv12 13.14? 13.16? 19.00? T:xoodyakround3 13.87 14.22 14.41 ascon128abi32v12 18.52 18.54 18.58 T:schwaemm256128v2 20.34 21.16 21.18 ascon128bi32v12 23.47 23.62 23.90 T:schwaemm256256v2 24.43 24.47 24.50 T:schwaemm192192v2 25.26 25.29 25.31 T:grain128aeadv2 27.08 27.23 28.01 T:schwaemm128128v2 29.68 29.93 30.16 T:isapa128v20 31.16 31.19 31.96 romulusn 35.05 35.08 35.12 T:isapa128av20 41.54 41.57 41.60 T:giftcofb128v1 43.12 43.16 43.19 romulusm 50.22? 53.34? 72.60? T:tinyjambu128v2 57.71 57.96 59.82 T:tinyjambu192v2 54.30 58.25 58.52 T:isapk128av20 62.11? 63.85? 89.97? T:tinyjambu256v2 75.43 75.57 75.77 T:isapk128v20 84.18? 84.28? 122.45? romulust 114.05 114.16 114.34 T:elephant200v2 149.12 149.40 149.64 T:isapxv20 5428.76 5432.95 5437.13 T:elephant176v2 6399.53 6419.13 6421.59 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.95 0.97 0.99 T:aes128gcmv1 1.24 1.25 1.28 aes256gcmv1 7.11 7.14 7.85 ascon128av12 10.46 10.51 10.77 ascon80pqv12 10.46? 10.53? 11.92? ascon128v12 13.01? 13.04? 18.96? T:xoodyakround3 13.81 14.18 14.34 ascon128abi32v12 18.54 18.59 18.63 T:schwaemm256128v2 20.62? 21.35? 23.19? ascon128bi32v12 23.47 23.73 23.86 T:schwaemm256256v2 24.46 24.49 24.55 T:schwaemm192192v2 25.40 25.47 25.51 T:grain128aeadv2 27.12 27.26 28.80 T:schwaemm128128v2 29.64 29.94 30.18 T:isapa128v20 31.16 31.19 31.21 romulusn 35.04 35.08 35.13 T:isapa128av20 41.55 41.58 41.62 T:giftcofb128v1 43.17 43.18 43.22 romulusm 50.23? 53.64? 72.67? T:tinyjambu128v2 54.27 58.17 58.38 T:isapk128av20 58.21 58.36 58.47 T:tinyjambu192v2 62.16? 62.26? 89.95? T:tinyjambu256v2 75.44 75.61 75.78 T:isapk128v20 84.21? 84.24? 122.47? romulust 113.95 114.08 114.23 T:elephant200v2 149.25 149.44 149.52 T:isapxv20 5427.26 5430.91 5433.10 T:elephant176v2 6400.33 6419.30 6420.34 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.96 0.97 0.99 T:aes128gcmv1 1.26 1.27 1.28 aes256gcmv1 7.13? 7.18? 8.61? ascon128av12 10.46 10.48 10.50 ascon128v12 11.16? 12.11? 13.56? ascon80pqv12 13.03? 13.06? 18.96? T:xoodyakround3 13.81 14.18 14.35 ascon128abi32v12 17.75 18.56 18.61 T:schwaemm256128v2 19.49 19.58 19.91 T:isapa128v20 20.62 21.34 21.43 ascon128bi32v12 23.45 23.50 23.76 T:schwaemm256256v2 24.49 24.52 24.55 T:schwaemm192192v2 25.44 25.49 25.52 T:grain128aeadv2 27.11 27.24 29.10 T:schwaemm128128v2 28.41 28.44 28.46 T:isapa128av20 31.16 31.22 31.42 romulusn 41.57 41.61 41.63 T:giftcofb128v1 42.89? 42.95? 62.74? romulust 43.17 43.19 43.21 romulusm 43.77 46.31 47.42 T:isapk128av20 50.22? 51.86? 72.67? T:tinyjambu128v2 57.86 57.99 58.37 T:isapk128v20 58.15 58.31 58.42 T:tinyjambu192v2 61.39? 64.67? 89.95? T:tinyjambu256v2 111.08 111.22 111.27 T:isapxv20 114.05 114.18 114.43 T:elephant200v2 5426.45 5431.23 5434.83 T:elephant176v2 6397.52 6418.09 6421.09 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.39 0.40 0.41 aes256gcmv1 0.41 0.43 0.45 T:aes128gcmv1 7.06 7.10 7.13 ascon128av12 9.10 9.15 9.17 T:xoodyakround3 10.44? 10.56? 11.96? ascon80pqv12 10.54 10.57 10.59 ascon128v12 14.14? 14.35? 20.95? ascon128abi32v12 18.36? 18.46? 21.74? T:schwaemm256128v2 19.71 19.75 19.81 T:isapa128v20 21.26? 21.33? 24.31? ascon128bi32v12 23.36 23.40 23.65 T:schwaemm256256v2 23.90 23.92 23.96 romulusn 23.93 23.98 24.02 romulusm 24.25 24.30 24.35 T:schwaemm192192v2 25.17 25.24 25.27 T:grain128aeadv2 26.92 26.98 27.17 T:schwaemm128128v2 28.42 28.45 28.49 T:isapa128av20 39.25 39.29 39.33 T:tinyjambu128v2 41.41 41.47 41.54 T:giftcofb128v1 42.07 42.09 42.19 T:tinyjambu256v2 42.06 42.13 44.59 T:tinyjambu192v2 42.74 42.89 43.06 romulust 46.25 46.38 48.31 T:isapk128av20 57.94 58.17 61.09 T:isapk128v20 76.84 77.04 77.29 T:elephant200v2 111.01 111.28 111.52 T:isapxv20 3593.50 3596.14 3598.16 T:elephant176v2 4265.35 4280.65 4283.82 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.39 0.40 0.41 aes256gcmv1 0.42 0.44 0.45 T:aes128gcmv1 7.09 7.12 7.14 ascon128av12 9.10 9.13 9.18 T:xoodyakround3 10.40 10.43 10.45 ascon128v12 10.40? 10.47? 11.99? ascon80pqv12 14.22? 16.36? 20.96? ascon128abi32v12 18.37 18.43 18.47 T:schwaemm256128v2 19.73 19.79 19.84 T:isapa128v20 21.46 21.52 21.59 ascon128bi32v12 23.35 23.39 23.65 T:schwaemm256256v2 23.90 23.94 23.97 romulusn 23.92 23.94 23.96 romulusm 24.26 24.32 24.44 T:schwaemm192192v2 25.16 25.21 25.24 T:grain128aeadv2 26.90 26.96 26.99 T:schwaemm128128v2 28.39 28.44 28.50 T:isapa128av20 39.26 39.30 39.34 T:tinyjambu128v2 41.43 41.50 41.55 T:giftcofb128v1 42.05? 42.07? 46.82? T:tinyjambu256v2 41.93 42.60 43.92 T:tinyjambu192v2 42.77 43.06 43.16 romulust 46.26 46.34 46.45 T:isapk128av20 57.90 58.17 60.59 T:isapk128v20 76.82 76.95 77.11 T:elephant200v2 110.89 111.27 111.46 T:isapxv20 3592.18 3595.04 3597.92 T:elephant176v2 4267.56 4281.38 4286.70 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.39 0.40 0.41 aes256gcmv1 0.43 0.43 0.44 T:aes128gcmv1 7.10 7.13 7.16 ascon128av12 9.07 9.11 9.18 T:xoodyakround3 10.41 10.44 10.46 ascon128v12 10.43? 10.46? 11.95? ascon80pqv12 14.19? 17.28? 20.90? ascon128abi32v12 18.30 18.36 18.42 T:schwaemm256128v2 19.66 19.73 19.81 T:isapa128v20 21.50 21.54 21.56 ascon128bi32v12 23.35 23.38 23.63 T:schwaemm256256v2 23.90 23.91 23.94 romulusn 23.90 23.93 23.97 romulusm 24.27 24.33 24.35 T:schwaemm192192v2 25.20 25.23 25.24 T:grain128aeadv2 26.93 26.97 27.02 T:schwaemm128128v2 28.41 28.47 28.51 T:isapa128av20 39.25 39.31 39.36 T:tinyjambu128v2 41.45 41.48 41.50 T:giftcofb128v1 42.06 42.08 42.09 T:tinyjambu256v2 42.71 42.78 43.01 romulust 42.47 44.31 47.10 T:tinyjambu192v2 46.19 46.38 46.96 T:isapk128av20 57.90 58.13 60.26 T:isapk128v20 76.91 77.04 77.23 T:elephant200v2 111.07 111.30 111.52 T:isapxv20 3592.69 3595.12 3597.47 T:elephant176v2 4265.76 4280.79 4283.99 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 1.00 1.00 1.02 T:aes128gcmv1 1.39 1.40 1.40 aes256gcmv1 7.30 7.31 7.33 ascon128av12 10.71 10.71 10.74 ascon128v12 10.74? 10.82? 15.05? ascon80pqv12 13.22 13.25 13.28 T:xoodyakround3 14.68? 14.78? 20.76? ascon128abi32v12 19.07 19.08 19.10 T:schwaemm256128v2 21.40 21.49 21.52 ascon128bi32v12 24.10 24.30 24.38 T:schwaemm256256v2 25.01 25.03 25.05 T:schwaemm192192v2 25.68 25.70 25.73 T:grain128aeadv2 27.43 27.45 27.68 T:schwaemm128128v2 31.47 31.49 31.52 romulusn 37.58 37.62 37.64 T:isapa128av20 41.92 41.93 41.95 T:giftcofb128v1 43.46 43.51 43.57 romulusm 43.85 43.89 44.04 T:isapa128v20 50.56 50.58 50.59 T:tinyjambu128v2 58.05 58.07 58.31 T:tinyjambu192v2 62.64 62.64 62.66 T:tinyjambu256v2 65.26 65.38 67.03 T:isapk128av20 85.52 85.69 85.80 romulust 116.45 116.51 116.62 T:elephant200v2 130.38 130.49 130.56 T:isapk128v20 244.91 245.01 245.20 T:isapxv20 5469.38 5472.33 5476.88 T:elephant176v2 6489.10 6490.91 6491.29 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 1.10 1.11 1.20 T:aes128gcmv1 1.42 1.43 1.45 aes256gcmv1 7.29 7.30 7.31 ascon128av12 10.62 10.64 11.53 ascon128v12 10.65? 10.72? 15.08? ascon80pqv12 13.15 13.18 13.19 T:xoodyakround3 14.65? 14.74? 20.76? ascon128abi32v12 19.07 19.09 19.12 T:schwaemm256128v2 21.69 21.71 21.74 ascon128bi32v12 24.12 24.35 24.46 T:schwaemm256256v2 25.03 25.04 25.07 T:schwaemm192192v2 25.84 25.86 25.89 T:grain128aeadv2 27.45 27.47 27.52 T:schwaemm128128v2 31.51 31.52 31.56 romulusn 37.61 37.61 37.65 T:isapa128av20 41.93 41.95 41.97 T:giftcofb128v1 43.59 43.60 43.62 romulusm 43.81 43.92 44.11 T:isapa128v20 50.60 50.62 50.69 T:tinyjambu128v2 58.79 58.85 58.88 T:tinyjambu192v2 62.63 62.64 62.66 T:tinyjambu256v2 65.30 65.40 66.61 T:isapk128av20 85.52 85.67 85.85 romulust 116.53 116.59 116.77 T:elephant200v2 130.44 130.57 131.06 T:isapk128v20 244.87 245.05 245.17 T:isapxv20 5466.94 5472.10 5474.24 T:elephant176v2 6475.15 6490.63 6491.82 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 1.10 1.11 1.12 T:aes128gcmv1 1.43 1.44 1.45 aes256gcmv1 7.29 7.31 7.32 ascon128av12 10.63? 10.66? 12.38? ascon128v12 10.66? 10.69? 15.07? ascon80pqv12 13.17 13.18 13.19 T:xoodyakround3 14.66? 14.74? 20.71? ascon128abi32v12 19.07 19.10 19.12 T:schwaemm256128v2 21.67 21.70 21.73 ascon128bi32v12 24.10 24.12 24.35 T:schwaemm256256v2 25.04 25.07 25.08 T:schwaemm192192v2 25.85 25.86 25.91 T:grain128aeadv2 26.68 26.73 26.98 T:isapa128v20 27.47 27.49 27.51 T:schwaemm128128v2 29.86 29.88 29.92 T:isapa128av20 31.50 31.51 31.54 romulusn 41.94 41.96 41.99 T:giftcofb128v1 43.59 43.61 43.63 romulusm 44.12 44.15 44.38 romulust 50.41 50.49 52.02 T:isapk128av20 50.58 50.62 50.68 T:tinyjambu128v2 58.64 58.83 58.87 T:tinyjambu192v2 62.63 62.63 62.66 T:tinyjambu256v2 86.13 86.21 86.34 T:isapk128v20 116.51 116.60 116.70 T:elephant200v2 160.11 160.15 160.28 T:isapxv20 5466.58 5471.83 5475.59 T:elephant176v2 6475.48 6490.63 6491.60 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 6.12 6.22 6.25 T:aes128gcmv1 7.38 7.47 7.53 aes256gcmv1 10.91 10.97 11.50 ascon128av12 14.00 14.12 14.25 ascon128v12 14.22? 14.47? 15.97? ascon80pqv12 19.00 19.22 19.62 T:xoodyakround3 21.72? 22.12? 24.50? ascon128abi32v12 29.31 29.44 29.91 ascon128bi32v12 30.81 30.94 31.34 T:schwaemm256128v2 34.47 34.50 34.62 T:grain128aeadv2 34.91 35.16 35.56 T:schwaemm128128v2 38.16 38.38 38.56 T:schwaemm256256v2 38.56 38.66 38.78 romulusn 40.06 40.56 40.81 T:schwaemm192192v2 49.75 49.88 50.06 T:giftcofb128v1 51.03 51.22 52.53 romulusm 59.41 59.59 59.81 T:tinyjambu128v2 68.22 68.28 68.31 T:tinyjambu192v2 73.16 73.38 73.78 T:tinyjambu256v2 95.06 95.38 96.03 T:isapa128av20 114.19 114.66 115.25 romulust 164.84 165.28 165.94 T:elephant200v2 214.00 214.56 216.06 T:isapk128av20 363.50 364.00 369.25 T:isapa128v20 1371.28 1372.97 1374.06 T:isapk128v20 2414.16 2414.78 2418.69 T:isapxv20 6802.50 6809.22 6814.00 T:elephant176v2 8674.44 8681.09 8686.62 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 6.38 6.47 6.53 T:aes128gcmv1 7.12 7.19 7.22 aes256gcmv1 10.97 11.06 11.47 ascon128av12 13.97 14.03 14.19 ascon128v12 14.16? 14.50? 15.75? ascon80pqv12 19.00 19.31 19.62 T:xoodyakround3 21.84? 24.47? 43.69? ascon128abi32v12 29.75 29.91 30.09 ascon128bi32v12 30.69 30.84 31.12 T:schwaemm256128v2 34.78 34.84 35.19 T:grain128aeadv2 35.00 35.06 35.31 T:schwaemm128128v2 38.19 38.44 38.66 T:schwaemm256256v2 38.66 38.78 38.97 romulusn 40.19 40.84 40.94 T:schwaemm192192v2 49.94 50.03 50.31 T:giftcofb128v1 53.31 53.41 53.62 romulusm 59.50 59.59 59.66 T:tinyjambu128v2 68.88 69.03 69.62 T:tinyjambu192v2 73.22 73.41 75.31 T:tinyjambu256v2 94.94 95.28 95.72 T:isapa128av20 114.25 114.62 115.12 romulust 164.56 165.41 166.34 T:elephant200v2 212.97 213.66 215.00 T:isapk128av20 363.59 371.22 389.81 T:isapa128v20 1372.38 1373.50 1376.31 T:isapk128v20 2411.62 2415.47 2417.81 T:isapxv20 6810.12 6813.09 6817.59 T:elephant176v2 8675.28 8679.00 8682.62 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 6.34 6.38 6.47 T:aes128gcmv1 7.12 7.16 7.19 aes256gcmv1 10.94 11.03 11.09 ascon128av12 13.91 14.00 14.03 ascon128v12 14.16? 14.41? 16.06? ascon80pqv12 19.09 19.19 19.75 T:xoodyakround3 21.81? 22.06? 24.72? ascon128abi32v12 29.75 29.88 30.50 ascon128bi32v12 30.66 30.75 30.97 T:schwaemm256128v2 34.72 34.88 35.25 T:schwaemm128128v2 34.78 34.88 34.91 T:grain128aeadv2 38.00 38.31 38.53 T:schwaemm256256v2 38.69 38.88 38.97 romulusn 40.03 40.75 40.88 T:schwaemm192192v2 49.78 49.91 50.00 T:giftcofb128v1 53.12 53.22 53.41 romulusm 59.28 59.41 59.59 T:tinyjambu128v2 62.28 62.50 62.78 T:isapa128av20 68.53 68.84 69.00 T:tinyjambu192v2 71.81 71.97 72.28 romulust 73.22 73.25 74.03 T:tinyjambu256v2 133.91 134.56 135.62 T:isapk128av20 164.75 165.31 165.50 T:elephant200v2 185.62 186.03 191.84 T:isapa128v20 719.62 720.00 721.31 T:isapk128v20 1262.66 1264.09 1267.66 T:isapxv20 6810.12 6812.75 6815.88 T:elephant176v2 8677.16 8682.41 8687.94 T:elephant160v2