VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: amd64; Zen 3 (a50f00); 2021 AMD Ryzen 5 PRO 5650G; 6 x 3900MHz; cezanne, supercop-20250922

[Page version: 20251103 11:56:58]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 1.71 1.72 1.72 T:aes128gcmv1 1.84 1.84 1.85 aes256gcmv1 5.84 5.86 5.88 ascon128av12 8.50 8.50 8.51 ascon80pqv12 8.62 8.62 8.67 ascon128v12 12.51 12.57 12.62 ascon128abi32v12 16.62 16.65 16.69 T:xoodyakround3 19.04 19.13 19.22 ascon128bi32v12 19.26 19.32 19.42 T:schwaemm256128v2 23.03 23.08 23.10 T:grain128aeadv2 23.84 24.54 24.75 T:schwaemm256256v2 25.94 25.99 26.08 T:schwaemm192192v2 28.95 29.05 29.18 T:schwaemm128128v2 34.14 34.14 34.14 T:isapa128v20 35.16 35.68 35.69 T:isapa128av20 37.08 37.10 37.14 romulusn 38.44 38.44 38.44 T:giftcofb128v1 58.46 58.47 58.48 T:tinyjambu128v2 59.31 59.35 59.40 romulusm 60.30 60.56 60.88 T:isapk128av20 65.30 65.62 65.62 T:tinyjambu256v2 66.05 66.05 66.05 T:tinyjambu192v2 78.34 78.58 79.66 T:isapk128v20 114.51 114.57 114.61 romulust 128.21? 149.22? 171.07? T:isapxv20 233.04? 255.16? 258.96? T:elephant200v2 6701.00 6718.26 6738.31 T:elephant176v2 7844.03 7844.74 7846.54 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 1.71 1.72 1.72 T:aes128gcmv1 1.82 1.83 1.83 aes256gcmv1 6.23 6.24 6.26 ascon128av12 8.37 8.38 8.38 ascon128v12 8.43 8.44 8.45 ascon80pqv12 12.66 12.69 12.72 ascon128abi32v12 16.41 16.48 16.53 T:xoodyakround3 18.48 18.50 18.53 ascon128bi32v12 19.34 19.40 19.47 T:schwaemm256128v2 22.97 22.98 23.12 T:grain128aeadv2 24.26 24.34 24.37 T:schwaemm256256v2 26.07 26.23 26.30 T:schwaemm192192v2 29.04 29.14 29.21 T:schwaemm128128v2 34.11 34.15 34.18 T:isapa128v20 35.64 35.70 35.71 T:isapa128av20 37.27 37.31 37.36 romulusn 38.49 38.50 38.51 T:giftcofb128v1 58.57 58.58 58.59 T:tinyjambu128v2 59.71 59.76 59.81 romulusm 60.40 60.84 61.35 T:isapk128av20 64.74 64.75 64.76 T:tinyjambu192v2 65.50 65.75 65.75 T:tinyjambu256v2 77.27 78.57 79.35 T:isapk128v20 114.45 114.52 114.62 romulust 149.03 149.73 150.15 T:isapxv20 232.53? 255.07? 258.72? T:elephant200v2 6700.22 6702.01 6717.49 T:elephant176v2 7844.97 7845.62 7845.94 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 1.71 1.72 1.72 T:aes128gcmv1 1.82 1.82 1.83 aes256gcmv1 6.24 6.24 6.26 ascon128av12 8.38 8.38 8.38 ascon128v12 8.44 8.45 8.45 ascon80pqv12 12.68 12.69 12.70 ascon128abi32v12 16.47 16.52 16.55 T:xoodyakround3 16.85 16.88 16.93 T:isapa128v20 18.48 18.50 18.53 ascon128bi32v12 19.32 19.37 19.43 T:schwaemm256128v2 22.97 22.99 23.09 T:grain128aeadv2 23.61 23.64 23.65 T:isapa128av20 24.23 24.37 24.45 T:schwaemm256256v2 26.06 26.14 26.23 T:schwaemm192192v2 29.04 29.19 29.27 T:schwaemm128128v2 37.29 37.32 37.35 romulusn 38.50 38.50 38.51 T:giftcofb128v1 38.75 38.85 38.94 romulust 40.45 40.78 41.03 T:isapk128av20 49.96 50.08 50.43 T:isapk128v20 58.58 58.58 58.59 T:tinyjambu128v2 59.69 59.74 59.78 romulusm 64.74 64.75 64.76 T:tinyjambu192v2 65.49 65.55 65.75 T:tinyjambu256v2 87.50 87.88 88.01 T:isapxv20 232.52? 255.06? 258.94? T:elephant200v2 6704.55 6706.83 6717.33 T:elephant176v2 7843.17 7843.87 7844.86 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 1.09 1.10 1.10 T:aes128gcmv1 1.14 1.15 1.15 aes256gcmv1 5.83 5.84 5.85 ascon128av12 8.37 8.38 8.39 ascon80pqv12 8.44 8.45 8.46 ascon128v12 12.41 12.41 12.44 ascon128abi32v12 12.65 12.66 12.69 T:xoodyakround3 18.84 18.85 18.87 ascon128bi32v12 19.08 19.18 19.27 T:schwaemm256128v2 23.00 23.02 23.03 T:grain128aeadv2 23.84 24.50 24.70 T:schwaemm256256v2 25.58 25.59 25.60 T:isapa128v20 25.89 25.95 26.27 T:schwaemm192192v2 29.02 29.09 29.13 T:schwaemm128128v2 29.40 29.64 29.65 T:isapa128av20 29.68 29.70 29.72 romulusn 38.39 38.41 38.42 T:giftcofb128v1 40.79 40.81 40.84 romulusm 47.54 47.61 47.62 T:tinyjambu128v2 48.38 48.58 49.04 T:isapk128av20 49.24 49.25 49.26 T:tinyjambu256v2 51.29 51.30 51.31 T:tinyjambu192v2 64.24 64.48 64.77 T:isapk128v20 76.66 76.70 76.76 romulust 108.35? 118.68? 128.96? T:isapxv20 173.77? 190.94? 193.17? T:elephant200v2 5005.55 5015.43 5031.47 T:elephant176v2 5883.17 5883.96 5901.49 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 1.08 1.09 1.11 T:aes128gcmv1 1.13 1.13 1.13 aes256gcmv1 6.04 6.05 6.06 ascon128av12 8.31 8.31 8.35 ascon128v12 8.35 8.35 8.35 ascon80pqv12 12.44 12.45 12.45 ascon128abi32v12 12.56 12.58 12.60 T:xoodyakround3 18.49 18.51 18.52 ascon128bi32v12 19.12 19.18 19.28 T:schwaemm256128v2 22.93 22.97 23.11 T:grain128aeadv2 24.17 24.28 24.30 T:schwaemm256256v2 25.56 25.58 25.59 T:isapa128v20 25.99 26.43 26.48 T:schwaemm192192v2 29.10 29.16 29.23 T:schwaemm128128v2 29.37 29.42 29.64 T:isapa128av20 29.79 29.81 29.82 romulusn 38.43 38.43 38.44 T:giftcofb128v1 41.00 41.02 41.04 romulusm 47.66 47.67 47.67 T:tinyjambu128v2 48.66 48.83 48.95 T:isapk128av20 49.35 49.37 49.39 T:tinyjambu256v2 50.60 50.62 50.66 T:tinyjambu192v2 64.28 64.60 64.78 T:isapk128v20 76.68 76.73 76.78 romulust 117.83 118.29 118.90 T:isapxv20 173.59? 191.27? 193.00? T:elephant200v2 5007.28 5026.91 5027.43 T:elephant176v2 5883.41 5883.84 5884.10 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 1.09 1.09 1.11 T:aes128gcmv1 1.13 1.13 1.13 aes256gcmv1 6.04 6.05 6.05 ascon128av12 8.31 8.31 8.33 ascon128v12 8.35 8.35 8.35 ascon80pqv12 12.44 12.45 12.45 ascon128abi32v12 12.57 12.59 12.64 T:xoodyakround3 16.92 16.95 16.97 T:isapa128v20 18.49 18.51 18.52 ascon128bi32v12 19.11 19.16 19.30 T:schwaemm256128v2 22.95 22.96 23.08 T:grain128aeadv2 23.63 23.63 23.64 T:isapa128av20 24.27 24.30 24.31 T:schwaemm256256v2 25.95 26.01 26.05 T:schwaemm192192v2 29.11 29.16 29.23 T:schwaemm128128v2 29.80 29.81 29.84 romulusn 38.43 38.44 38.45 T:giftcofb128v1 38.69 38.76 38.79 T:isapk128av20 38.82 38.87 38.90 romulust 40.99 41.02 41.05 romulusm 47.66 47.67 47.67 T:tinyjambu128v2 49.34 49.38 49.41 T:tinyjambu256v2 50.30 50.45 51.05 T:isapk128v20 50.65 50.65 50.67 T:tinyjambu192v2 86.30 86.60 87.16 T:isapxv20 173.76 190.60 192.65 T:elephant200v2 5007.09 5007.96 5016.49 T:elephant176v2 5883.04 5883.40 5883.90 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.44 0.45 0.45 aes256gcmv1 0.45 0.46 0.47 T:aes128gcmv1 5.80 5.80 5.81 ascon128av12 8.25 8.25 8.25 ascon80pqv12 8.25 8.25 8.26 ascon128v12 8.66 8.68 8.70 T:xoodyakround3 12.20 12.26 12.29 ascon128abi32v12 17.00 17.01 17.01 T:isapa128v20 18.57 18.57 18.58 ascon128bi32v12 18.91 18.95 18.99 T:schwaemm256128v2 22.27 22.29 22.34 romulusn 22.27 22.31 22.35 romulusm 22.93 22.97 22.99 T:grain128aeadv2 23.61 23.64 23.66 T:isapa128av20 23.81 24.44 24.51 T:schwaemm256256v2 25.82 25.87 25.95 T:schwaemm192192v2 29.03 29.14 29.27 T:schwaemm128128v2 33.24 33.25 33.26 T:tinyjambu256v2 36.22 36.41 36.66 T:isapk128av20 36.54 36.55 36.55 T:tinyjambu192v2 36.61 36.62 36.64 T:tinyjambu128v2 38.35 38.36 38.37 T:giftcofb128v1 38.79 38.86 38.93 romulust 49.47 49.92 51.43 T:isapk128v20 65.65? 86.99? 108.01? T:isapxv20 114.63? 126.55? 128.11? T:elephant200v2 3319.22 3323.69 3326.36 T:elephant176v2 3922.18 3922.75 3922.95 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.43 0.44 0.44 aes256gcmv1 0.45 0.46 0.47 T:aes128gcmv1 5.82 5.85 5.86 ascon128av12 8.25 8.25 8.25 ascon80pqv12 8.25 8.25 8.25 ascon128v12 8.62 8.69 8.75 T:xoodyakround3 12.16 12.19 12.22 ascon128abi32v12 16.97 17.01 17.05 T:isapa128v20 18.49 18.51 18.52 ascon128bi32v12 18.89 18.93 18.97 T:schwaemm256128v2 22.26 22.31 22.33 romulusm 22.29 22.31 22.34 romulusn 22.88 22.92 23.06 T:grain128aeadv2 23.62 23.63 23.64 T:isapa128av20 24.08 24.22 24.25 T:schwaemm256256v2 25.83 25.91 26.01 T:schwaemm192192v2 29.05 29.16 29.31 T:schwaemm128128v2 33.25 33.25 33.26 T:tinyjambu256v2 36.54 36.55 36.55 T:tinyjambu192v2 36.16 36.60 36.75 T:isapk128av20 36.74 36.75 36.75 T:tinyjambu128v2 38.35 38.36 38.39 T:giftcofb128v1 38.80 38.86 38.92 romulust 50.06 50.40 50.71 T:isapk128v20 85.61 87.24 88.08 T:isapxv20 112.49? 126.43? 127.74? T:elephant200v2 3311.44 3312.82 3323.56 T:elephant176v2 3922.23 3922.85 3933.93 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.43 0.43 0.44 aes256gcmv1 0.46 0.46 0.46 T:aes128gcmv1 5.83 5.85 5.86 ascon128av12 8.25 8.25 8.26 ascon80pqv12 8.25 8.25 8.26 ascon128v12 8.62 8.66 8.76 T:xoodyakround3 12.18 12.19 12.20 ascon128abi32v12 16.97 17.05 17.05 T:isapa128v20 18.48 18.51 18.52 ascon128bi32v12 18.91 18.94 19.28 T:schwaemm256128v2 22.26 22.31 22.33 romulusn 22.28 22.31 22.34 romulusm 22.87 22.90 23.13 T:grain128aeadv2 23.63 23.64 23.66 T:isapa128av20 24.10 24.22 24.24 T:schwaemm256256v2 25.83 25.89 26.36 T:schwaemm192192v2 29.05 29.18 29.25 T:schwaemm128128v2 32.97 33.25 33.28 T:tinyjambu256v2 36.55 36.55 36.56 T:tinyjambu192v2 36.61 36.75 36.77 T:tinyjambu128v2 36.34 36.79 36.89 T:isapk128av20 38.35 38.36 38.38 T:giftcofb128v1 38.80 38.86 38.90 romulust 50.33 50.67 50.88 T:isapk128v20 85.70 86.70 86.81 T:isapxv20 114.75 125.28 127.42 T:elephant200v2 3311.12 3312.65 3316.81 T:elephant176v2 3922.36 3922.63 3922.88 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 1.20 1.20 1.21 T:aes128gcmv1 1.27 1.27 1.28 aes256gcmv1 6.01 6.01 6.02 ascon128av12 8.51 8.51 8.52 ascon80pqv12 8.56 8.57 8.59 ascon128v12 12.70 12.71 12.73 ascon128abi32v12 12.79 12.80 12.83 T:xoodyakround3 19.18 19.18 19.20 ascon128bi32v12 19.72 19.76 19.79 T:schwaemm256128v2 23.33 23.36 23.38 T:grain128aeadv2 24.52 25.15 25.16 T:schwaemm256256v2 26.52 26.59 26.82 T:schwaemm192192v2 29.48 29.50 29.56 T:schwaemm128128v2 29.93 29.95 29.96 romulusn 33.58 33.59 33.81 T:isapa128av20 37.21 37.22 37.24 T:isapa128v20 38.74 38.76 38.76 T:giftcofb128v1 41.06 41.09 41.09 romulusm 47.99 48.00 48.03 T:tinyjambu128v2 49.64 49.64 49.65 T:tinyjambu256v2 51.70 51.71 51.72 T:tinyjambu192v2 54.39 54.58 55.25 T:isapk128av20 77.75 77.83 77.88 romulust 108.64 108.80 108.85 T:isapk128v20 192.06 192.71 206.01 T:isapxv20 178.42 195.28 196.54 T:elephant200v2 5044.50 5045.77 5053.95 T:elephant176v2 5949.90 5950.22 5950.41 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 1.20 1.20 1.21 T:aes128gcmv1 1.26 1.26 1.26 aes256gcmv1 6.19 6.19 6.21 ascon128av12 8.44 8.44 8.48 ascon128v12 8.47 8.47 8.48 ascon80pqv12 12.71 12.73 12.74 T:xoodyakround3 12.73 12.74 12.75 ascon128abi32v12 18.86 18.86 18.87 ascon128bi32v12 19.71 19.75 19.78 T:schwaemm256128v2 23.31 23.35 23.44 T:grain128aeadv2 24.85 24.96 24.97 T:schwaemm256256v2 26.65 26.69 26.86 T:schwaemm192192v2 29.51 29.54 29.61 T:schwaemm128128v2 30.06 30.07 30.10 romulusn 33.58 33.59 33.82 T:isapa128av20 37.21 37.21 37.23 T:isapa128v20 38.79 38.80 38.80 T:giftcofb128v1 41.31 41.33 41.35 romulusm 48.08 48.08 48.09 T:tinyjambu128v2 49.77 49.77 49.81 T:tinyjambu256v2 51.08 51.13 51.13 T:tinyjambu192v2 54.50 54.80 55.99 T:isapk128av20 77.82 77.87 77.91 romulust 109.85 109.92 110.35 T:isapk128v20 192.47 192.89 193.32 T:isapxv20 178.35 194.08 195.49 T:elephant200v2 5045.34 5055.12 5070.25 T:elephant176v2 5949.80 5949.95 5951.04 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 1.20 1.20 1.20 T:aes128gcmv1 1.25 1.26 1.26 aes256gcmv1 6.20 6.20 6.20 ascon128av12 8.44 8.44 8.46 ascon128v12 8.47 8.47 8.48 ascon80pqv12 12.73 12.73 12.74 ascon128abi32v12 12.73 12.74 12.76 T:xoodyakround3 18.86 18.86 18.87 ascon128bi32v12 19.72 19.73 19.76 T:schwaemm256128v2 22.86 22.86 22.88 T:isapa128v20 23.29 23.31 23.44 T:grain128aeadv2 24.87 24.97 25.10 T:schwaemm256256v2 25.92 25.92 25.92 T:isapa128av20 26.66 26.84 27.01 T:schwaemm192192v2 29.48 29.53 29.64 T:schwaemm128128v2 30.05 30.06 30.07 romulusn 38.79 38.79 38.81 T:giftcofb128v1 39.93 39.95 40.00 romulust 41.31 41.34 41.36 romulusm 42.25 42.26 42.28 T:isapk128av20 48.08 48.09 48.09 T:tinyjambu128v2 49.77 49.81 49.81 T:tinyjambu256v2 51.13 51.14 51.14 T:tinyjambu192v2 73.54 73.62 73.69 T:isapk128v20 124.39 125.36 127.19 T:isapxv20 178.83 194.23 195.38 T:elephant200v2 5044.93 5048.13 5054.15 T:elephant176v2 5949.53 5950.01 5950.22 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 5.51 5.56 5.62 T:aes128gcmv1 6.09 6.12 6.18 aes256gcmv1 9.79 9.84 9.84 ascon128av12 11.40 11.40 11.48 ascon128v12 11.40 11.40 11.58 ascon80pqv12 18.38 18.48 18.67 T:xoodyakround3 19.29 19.64 20.14 ascon128abi32v12 26.52 26.74 27.24 ascon128bi32v12 31.48 31.59 31.61 T:grain128aeadv2 32.75 32.95 33.47 T:schwaemm256128v2 35.66 35.81 35.90 romulusn 38.42 38.66 38.89 T:schwaemm128128v2 39.73 40.33 40.51 T:schwaemm256256v2 43.32 43.63 43.83 T:schwaemm192192v2 46.46 46.66 46.81 T:giftcofb128v1 46.76 46.92 47.12 romulusm 56.67 57.69 58.05 T:tinyjambu128v2 58.46 58.58 58.73 T:tinyjambu256v2 61.04 61.09 61.23 T:tinyjambu192v2 103.25 103.48 103.69 romulust 128.83 128.85 128.94 T:isapa128av20 183.97 186.49 189.06 T:isapk128av20 250.08 272.03 273.38 T:elephant200v2 304.56 304.69 304.77 T:isapa128v20 1111.59 1116.38 1123.33 T:isapk128v20 1880.95? 1896.44? 2203.83? T:isapxv20 6285.48 6292.59 6298.04 T:elephant176v2 7969.26 7971.05 7987.03 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 5.25 5.27 5.31 T:aes128gcmv1 5.60 5.66 5.69 aes256gcmv1 9.91 9.91 9.95 ascon128av12 11.36 11.36 11.45 ascon128v12 11.34 11.41 11.47 ascon80pqv12 18.34 18.46 18.59 T:xoodyakround3 19.54 19.55 19.88 ascon128abi32v12 26.93 26.93 27.25 ascon128bi32v12 31.32 31.46 32.17 T:grain128aeadv2 32.77 33.05 33.91 T:schwaemm256128v2 35.99 36.14 36.29 romulusn 38.63 39.05 39.55 T:schwaemm128128v2 39.96 40.45 40.57 T:schwaemm256256v2 43.04 43.19 43.93 T:schwaemm192192v2 46.86 47.12 47.29 T:giftcofb128v1 48.37 48.46 48.63 romulusm 57.48 57.57 58.52 T:tinyjambu128v2 58.90 59.70 59.79 T:tinyjambu256v2 62.04 62.35 62.40 T:tinyjambu192v2 103.67 103.84 104.02 romulust 129.01 129.02 129.55 T:isapa128av20 184.22 184.54 188.39 T:isapk128av20 250.24 271.88 272.66 T:elephant200v2 304.65 305.13 305.30 T:isapa128v20 1138.67 1141.66 1141.98 T:isapk128v20 1888.73 1891.56 1891.62 T:isapxv20 6281.88 6286.84 6290.52 T:elephant176v2 7968.45 7969.69 7986.27 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 5.25 5.28 5.34 T:aes128gcmv1 5.61 5.65 5.70 aes256gcmv1 9.91 9.95 9.95 ascon128av12 11.34 11.34 11.41 ascon80pqv12 11.36 11.36 11.38 ascon128v12 18.34 18.48 19.12 T:xoodyakround3 19.52 19.58 19.59 ascon128abi32v12 26.95 26.97 27.26 ascon128bi32v12 31.53 31.70 32.03 T:grain128aeadv2 32.76 33.09 33.47 T:schwaemm256128v2 36.01 36.07 36.19 romulusn 38.48 38.85 39.38 T:schwaemm128128v2 39.90 40.45 40.50 T:schwaemm256256v2 43.05 43.27 43.68 T:schwaemm192192v2 46.90 47.10 47.20 T:giftcofb128v1 48.31 48.46 48.66 romulusm 57.49 57.52 57.58 T:tinyjambu128v2 58.84 59.60 59.72 T:tinyjambu256v2 60.70 62.24 62.27 T:tinyjambu192v2 64.72 65.12 65.23 romulust 77.27 77.28 77.53 T:isapa128av20 115.70 116.53 117.44 T:isapk128av20 158.71 158.71 159.31 T:isapa128v20 249.93 271.69 272.77 T:elephant200v2 599.93 600.56 602.12 T:isapk128v20 981.49 985.06 985.51 T:isapxv20 6283.54 6284.31 6292.84 T:elephant176v2 7967.01 7968.55 7970.36 T:elephant160v2