VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: amd64; Comet Lake (806ec); 2019 Intel Core i3-10110U; 2 x 2100MHz; cubi10, supercop-20250922

[Page version: 20251103 11:56:58]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 1.40 1.40 1.41 T:aes128gcmv1 1.63 1.65 1.65 aes256gcmv1 7.55 7.59 7.64 ascon128av12 10.85 10.90 10.93 ascon80pqv12 10.96 11.00 11.03 ascon128v12 14.26 14.30 14.34 ascon128abi32v12 16.74 16.80 16.82 T:xoodyakround3 19.11 19.18 19.26 T:schwaemm256128v2 21.29 21.32 21.36 T:schwaemm256256v2 21.34 21.36 21.41 ascon128bi32v12 25.07 25.15 25.18 T:grain128aeadv2 25.14 25.27 25.34 T:schwaemm192192v2 27.53 27.56 27.62 T:schwaemm128128v2 38.57 38.59 38.62 romulusn 41.14 41.17 41.22 T:giftcofb128v1 41.30 41.35 41.39 T:isapa128av20 45.43 45.58 45.69 T:isapa128v20 60.19 60.24 60.28 T:tinyjambu128v2 61.93 61.96 61.98 romulusm 68.43 68.63 68.73 T:isapk128av20 72.33 72.40 72.44 T:tinyjambu192v2 78.71 78.93 79.04 T:tinyjambu256v2 91.41 91.55 91.68 T:isapk128v20 124.62 124.69 124.80 romulust 142.43 142.56 142.70 T:elephant200v2 166.96? 178.65? 189.96? T:isapxv20 7511.05 7513.28 7515.34 T:elephant176v2 8184.65 8188.44 8189.64 T:elephant160v2

Cycles/byte for long+0 decrypt 25% 50% 75% aead 1.44 1.45 1.46 T:aes128gcmv1 1.57 1.59 1.60 aes256gcmv1 7.47 7.50 7.51 ascon128av12 10.87 10.88 10.93 ascon80pqv12 10.93 10.97 10.99 ascon128v12 14.12 14.16 14.19 ascon128abi32v12 16.29 16.31 16.36 T:xoodyakround3 19.12 19.17 19.25 T:schwaemm256128v2 21.28 21.31 21.35 T:schwaemm256256v2 21.41 21.46 21.48 ascon128bi32v12 25.17 25.25 25.35 T:schwaemm192192v2 25.66 25.66 25.70 T:grain128aeadv2 27.50 27.55 27.57 T:schwaemm128128v2 38.46 38.50 38.52 romulusn 41.20 41.24 41.29 T:giftcofb128v1 41.25 41.33 41.39 T:isapa128av20 45.48 45.65 45.77 T:isapa128v20 60.22 60.29 60.39 T:tinyjambu128v2 61.89 61.95 61.98 romulusm 68.48 68.60 68.80 T:isapk128av20 72.44 72.48 72.55 T:tinyjambu192v2 78.61 78.66 78.78 T:tinyjambu256v2 91.48 91.55 91.62 T:isapk128v20 124.61 124.69 124.76 romulust 142.30 142.42 142.50 T:elephant200v2 166.95? 178.60? 189.81? T:isapxv20 7512.49 7515.12 7517.52 T:elephant176v2 8183.61 8185.77 8188.90 T:elephant160v2

Cycles/byte for long+0 forgery 25% 50% 75% aead 1.45 1.45 1.46 T:aes128gcmv1 1.59 1.59 1.59 aes256gcmv1 7.46 7.48 7.51 ascon128av12 10.87 10.92 10.96 ascon80pqv12 10.90 10.94 10.96 ascon128v12 14.14 14.16 14.21 ascon128abi32v12 16.33 16.35 16.39 T:xoodyakround3 19.12 19.23 19.28 T:schwaemm256128v2 21.28 21.33 21.37 T:schwaemm256256v2 21.41 21.45 21.48 ascon128bi32v12 22.60 22.67 22.76 T:isapa128v20 25.17 25.27 25.33 T:schwaemm192192v2 25.67 25.70 25.73 T:grain128aeadv2 27.08 27.15 27.24 T:isapa128av20 27.50 27.55 27.57 T:schwaemm128128v2 38.46 38.49 38.51 romulusn 41.22 41.24 41.28 T:giftcofb128v1 42.48 42.55 42.64 romulust 45.80 46.03 46.17 T:isapk128av20 57.40 57.46 57.52 T:isapk128v20 60.23 60.33 60.40 T:tinyjambu128v2 61.92 61.96 61.99 romulusm 72.46 72.50 72.57 T:tinyjambu192v2 78.61 78.64 78.71 T:tinyjambu256v2 106.85 106.99 107.53 T:isapxv20 142.38 142.47 142.58 T:elephant200v2 7512.45 7514.44 7516.53 T:elephant176v2 8185.55 8189.42 8190.60 T:elephant160v2

Cycles/byte for long+long encrypt 25% 50% 75% aead 0.90 0.90 0.91 T:aes128gcmv1 1.02 1.03 1.04 aes256gcmv1 7.57 7.59 7.61 ascon128av12 10.93 10.95 10.97 ascon80pqv12 10.98 11.00 11.02 ascon128v12 12.71 12.72 12.76 T:xoodyakround3 14.30 14.33 14.37 ascon128abi32v12 18.97 19.03 19.07 T:schwaemm256128v2 21.22 21.25 21.29 T:schwaemm256256v2 21.32 21.35 21.37 ascon128bi32v12 25.08 25.18 25.23 T:schwaemm192192v2 25.09 25.21 25.22 T:grain128aeadv2 28.11 28.16 28.25 T:schwaemm128128v2 31.02 31.05 31.07 romulusn 34.17 34.23 34.29 T:isapa128v20 34.20 34.24 34.28 T:isapa128av20 41.38 41.40 41.43 T:giftcofb128v1 42.71 42.74 42.76 romulusm 49.32 49.36 49.41 T:tinyjambu128v2 56.71 56.74 56.79 T:tinyjambu192v2 57.56 57.62 57.69 T:isapk128av20 59.60 59.73 59.88 T:tinyjambu256v2 74.29 74.34 74.48 T:isapk128v20 83.44 83.49 83.61 romulust 107.43 107.50 107.63 T:elephant200v2 136.89 142.71 148.45 T:isapxv20 5608.34 5611.84 5612.93 T:elephant176v2 6139.75 6142.23 6142.73 T:elephant160v2

Cycles/byte for long+long decrypt 25% 50% 75% aead 0.90 0.93 0.93 T:aes128gcmv1 0.99 1.00 1.01 aes256gcmv1 7.52 7.53 7.55 ascon128av12 10.69 10.73 10.75 ascon128v12 10.91 10.93 10.96 ascon80pqv12 12.51 12.52 12.53 T:xoodyakround3 14.30 14.32 14.35 ascon128abi32v12 19.00 19.05 19.11 T:schwaemm256128v2 21.23 21.24 21.27 T:schwaemm256256v2 21.41 21.45 21.47 ascon128bi32v12 25.04 25.09 25.14 T:schwaemm192192v2 25.38 25.40 25.41 T:grain128aeadv2 28.14 28.17 28.20 T:schwaemm128128v2 30.99 31.00 31.03 romulusn 34.22 34.28 34.32 T:isapa128av20 34.21 34.29 34.36 T:isapa128v20 41.42 41.45 41.47 T:giftcofb128v1 42.72 42.75 42.77 romulusm 49.33 49.37 49.42 T:tinyjambu128v2 56.77 56.80 56.84 T:tinyjambu192v2 57.41 57.56 57.61 T:isapk128av20 59.62 59.64 59.66 T:tinyjambu256v2 74.26 74.31 74.37 T:isapk128v20 83.44 83.54 83.64 romulust 107.46 107.54 107.59 T:elephant200v2 136.94 142.72 148.39 T:isapxv20 5607.54 5610.00 5612.04 T:elephant176v2 6139.20 6141.42 6142.36 T:elephant160v2

Cycles/byte for long+long forgery 25% 50% 75% aead 0.92 0.93 0.93 T:aes128gcmv1 1.00 1.00 1.01 aes256gcmv1 7.51 7.54 7.56 ascon128av12 10.71 10.73 10.75 ascon128v12 10.92 10.93 10.97 ascon80pqv12 12.53 12.54 12.56 T:xoodyakround3 14.29 14.31 14.34 ascon128abi32v12 18.91 19.03 19.07 T:schwaemm256128v2 21.23 21.24 21.27 T:schwaemm256256v2 21.42 21.43 21.46 ascon128bi32v12 22.76 22.80 22.86 T:isapa128v20 25.01 25.08 25.15 T:schwaemm192192v2 25.39 25.40 25.43 T:grain128aeadv2 27.12 27.15 27.21 T:isapa128av20 28.13 28.17 28.20 T:schwaemm128128v2 30.98 31.00 31.02 romulusn 41.44 41.45 41.48 T:giftcofb128v1 42.38 42.43 42.50 romulust 42.73 42.75 42.77 romulusm 46.15 46.26 46.34 T:isapk128av20 49.37 49.39 49.44 T:tinyjambu128v2 56.76 56.81 56.83 T:tinyjambu192v2 57.20 57.27 57.39 T:isapk128v20 59.60 59.62 59.64 T:tinyjambu256v2 106.15 106.92 107.01 T:isapxv20 107.51 107.56 107.61 T:elephant200v2 5607.92 5610.12 5611.25 T:elephant176v2 6139.64 6140.97 6142.62 T:elephant160v2

Cycles/byte for 0+long encrypt 25% 50% 75% aead 0.38 0.40 0.41 T:aes128gcmv1 0.40 0.42 0.42 aes256gcmv1 7.54 7.58 7.61 ascon128av12 8.77 8.79 8.82 T:xoodyakround3 10.93 10.96 10.99 ascon80pqv12 10.96 10.98 11.02 ascon128v12 14.27 14.30 14.36 ascon128abi32v12 18.83 18.88 18.99 T:schwaemm256128v2 21.09 21.12 21.16 T:schwaemm256256v2 21.30 21.32 21.35 ascon128bi32v12 22.78 22.87 22.95 T:isapa128v20 23.47 23.48 23.53 romulusn 23.51 23.55 23.58 romulusm 24.89 25.00 25.08 T:schwaemm192192v2 25.11 25.20 25.22 T:grain128aeadv2 27.12 27.16 27.23 T:isapa128av20 28.70 28.74 28.81 T:schwaemm128128v2 38.41 38.44 38.48 T:tinyjambu128v2 40.62 40.67 40.78 T:tinyjambu256v2 41.08 41.14 41.20 T:tinyjambu192v2 41.60 41.63 41.67 T:giftcofb128v1 42.30 42.36 42.44 romulust 46.35 46.56 46.73 T:isapk128av20 57.03 57.21 57.35 T:isapk128v20 72.18 72.27 72.33 T:elephant200v2 106.88 106.96 107.02 T:isapxv20 3707.50 3708.63 3709.19 T:elephant176v2 4091.39 4093.43 4094.61 T:elephant160v2

Cycles/byte for 0+long decrypt 25% 50% 75% aead 0.40 0.41 0.42 T:aes128gcmv1 0.39 0.42 0.42 aes256gcmv1 7.55 7.58 7.60 ascon128av12 8.78 8.80 8.84 T:xoodyakround3 10.52 10.57 10.61 ascon128v12 10.93 10.96 10.98 ascon80pqv12 14.43 14.45 14.47 ascon128abi32v12 18.83 18.90 18.95 T:schwaemm256128v2 21.08 21.11 21.15 T:schwaemm256256v2 21.40 21.45 21.47 ascon128bi32v12 22.81 22.92 22.98 T:isapa128v20 23.47 23.49 23.54 romulusn 23.51 23.54 23.59 romulusm 24.86 24.99 25.03 T:schwaemm192192v2 25.07 25.08 25.10 T:grain128aeadv2 27.07 27.14 27.18 T:isapa128av20 28.68 28.73 28.79 T:schwaemm128128v2 38.44 38.49 38.52 T:tinyjambu128v2 40.65 40.70 40.74 T:tinyjambu256v2 41.06 41.14 41.20 T:tinyjambu192v2 41.58 41.63 41.70 T:giftcofb128v1 42.33 42.38 42.48 romulust 46.19 46.53 46.66 T:isapk128av20 57.10 57.15 57.27 T:isapk128v20 72.18 72.26 72.30 T:elephant200v2 106.88 106.99 107.11 T:isapxv20 3706.95 3707.81 3708.81 T:elephant176v2 4091.41 4093.56 4094.65 T:elephant160v2

Cycles/byte for 0+long forgery 25% 50% 75% aead 0.41 0.41 0.42 T:aes128gcmv1 0.41 0.42 0.42 aes256gcmv1 7.56 7.58 7.61 ascon128av12 8.79 8.83 8.86 T:xoodyakround3 10.49 10.53 10.61 ascon128v12 10.91 10.95 10.99 ascon80pqv12 14.41 14.45 14.47 ascon128abi32v12 18.89 18.96 19.02 T:schwaemm256128v2 21.09 21.14 21.17 T:schwaemm256256v2 21.40 21.43 21.47 ascon128bi32v12 22.80 22.87 22.96 T:isapa128v20 23.49 23.51 23.55 romulusn 23.52 23.55 23.58 romulusm 24.87 24.97 25.06 T:schwaemm192192v2 25.06 25.09 25.12 T:grain128aeadv2 27.10 27.15 27.21 T:isapa128av20 28.72 28.77 28.84 T:schwaemm128128v2 38.45 38.48 38.53 T:tinyjambu128v2 40.65 40.68 40.75 T:tinyjambu256v2 41.07 41.15 41.20 T:tinyjambu192v2 41.59 41.63 41.68 T:giftcofb128v1 42.28 42.40 42.47 romulust 46.39 46.54 46.69 T:isapk128av20 57.08 57.17 57.24 T:isapk128v20 72.22 72.27 72.34 T:elephant200v2 106.85 106.96 107.08 T:isapxv20 3706.83 3707.54 3709.36 T:elephant176v2 4091.04 4093.24 4094.15 T:elephant160v2

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 1.06 1.06 1.07 T:aes128gcmv1 1.21 1.22 1.22 aes256gcmv1 7.77 7.79 7.80 ascon128av12 11.12 11.13 11.17 ascon80pqv12 11.17 11.18 11.20 ascon128v12 12.88 12.89 12.91 T:xoodyakround3 14.66 14.69 14.71 ascon128abi32v12 19.51 19.59 19.63 T:schwaemm256128v2 21.68 21.69 21.71 ascon128bi32v12 21.75 21.84 21.87 T:schwaemm256256v2 25.50 25.60 25.62 T:grain128aeadv2 25.64 25.66 25.71 T:schwaemm192192v2 28.51 28.54 28.55 T:schwaemm128128v2 31.36 31.37 31.39 romulusn 37.78 37.80 37.85 T:isapa128av20 41.80 41.82 41.83 T:giftcofb128v1 43.07 43.09 43.12 romulusm 49.73 49.76 49.79 T:tinyjambu128v2 49.95 50.02 50.07 T:isapa128v20 57.17 57.21 57.23 T:tinyjambu192v2 60.00 60.13 60.24 T:tinyjambu256v2 64.32 64.36 64.44 T:isapk128av20 84.81 84.84 84.90 romulust 109.71 109.83 109.90 T:elephant200v2 128.50 128.52 128.61 T:isapk128v20 234.81 234.85 241.97 T:isapxv20 5650.54 5653.06 5655.06 T:elephant176v2 6210.49 6210.76 6211.47 T:elephant160v2

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 1.08 1.08 1.09 T:aes128gcmv1 1.18 1.18 1.19 aes256gcmv1 7.71 7.72 7.74 ascon128av12 10.90 10.92 10.95 ascon128v12 11.10 11.11 11.19 ascon80pqv12 12.66 12.67 12.68 T:xoodyakround3 14.64 14.66 14.68 ascon128abi32v12 19.48 19.64 19.68 T:schwaemm256128v2 21.76 21.77 21.80 ascon128bi32v12 21.80 21.84 21.88 T:schwaemm256256v2 25.66 25.70 25.74 T:schwaemm192192v2 25.80 25.81 25.83 T:grain128aeadv2 28.52 28.55 28.56 T:schwaemm128128v2 31.32 31.33 31.34 romulusn 37.78 37.83 37.84 T:isapa128av20 41.88 41.91 41.92 T:giftcofb128v1 43.16 43.17 43.20 romulusm 49.79 49.80 49.82 T:tinyjambu128v2 49.99 50.00 50.07 T:isapa128v20 57.22 57.27 57.31 T:tinyjambu192v2 60.07 60.09 60.11 T:tinyjambu256v2 64.34 64.38 64.42 T:isapk128av20 84.82 84.85 84.94 romulust 109.84 109.89 109.94 T:elephant200v2 128.50 128.54 128.58 T:isapk128v20 233.63 234.93 242.00 T:isapxv20 5651.72 5653.46 5654.55 T:elephant176v2 6207.08 6207.56 6211.26 T:elephant160v2

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 1.08 1.08 1.09 T:aes128gcmv1 1.18 1.18 1.19 aes256gcmv1 7.72 7.73 7.75 ascon128av12 10.89 10.90 10.95 ascon128v12 11.10 11.11 11.15 ascon80pqv12 12.67 12.69 12.72 T:xoodyakround3 14.63 14.65 14.67 ascon128abi32v12 19.47 19.65 19.67 T:schwaemm256128v2 21.78 21.78 21.81 ascon128bi32v12 21.75 21.83 21.85 T:schwaemm256256v2 25.64 25.69 25.72 T:schwaemm192192v2 25.80 25.81 25.82 T:grain128aeadv2 28.50 28.53 28.57 T:schwaemm128128v2 29.08 29.10 29.15 T:isapa128av20 30.81 30.83 30.87 T:isapa128v20 31.33 31.34 31.36 romulusn 41.85 41.87 41.90 T:giftcofb128v1 43.17 43.19 43.20 romulusm 43.65 43.70 43.78 romulust 49.73 49.77 49.83 T:tinyjambu128v2 50.19 50.22 50.28 T:isapk128av20 57.25 57.28 57.30 T:tinyjambu192v2 60.08 60.08 60.09 T:tinyjambu256v2 85.04 85.07 85.10 T:isapk128v20 109.83 109.86 109.93 T:elephant200v2 154.06 154.09 154.15 T:isapxv20 5649.38 5653.96 5656.49 T:elephant176v2 6207.87 6210.78 6211.43 T:elephant160v2

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 6.61 6.65 6.70 T:aes128gcmv1 7.42 7.45 7.47 aes256gcmv1 11.91 12.04 12.31 ascon128av12 14.98 15.23 15.55 ascon128v12 15.03 15.45 15.71 ascon80pqv12 18.60 18.90 19.05 T:xoodyakround3 22.07 22.27 22.47 ascon128abi32v12 29.16 29.23 29.58 ascon128bi32v12 32.03 32.13 32.52 T:schwaemm256128v2 34.74 34.87 35.05 T:schwaemm256256v2 34.97 35.02 35.23 T:grain128aeadv2 36.04 36.24 36.33 T:schwaemm128128v2 38.52 38.68 38.80 romulusn 41.63 42.02 42.32 T:schwaemm192192v2 50.78 50.95 51.12 romulusm 51.22 51.43 51.70 T:giftcofb128v1 58.73 58.90 59.00 T:tinyjambu128v2 67.38 67.48 67.63 T:tinyjambu192v2 70.41 70.52 70.66 T:tinyjambu256v2 115.12 115.31 115.68 romulust 118.61 118.72 118.94 T:isapa128av20 156.99 157.31 157.99 T:elephant200v2 206.12 206.87 208.64 T:isapk128av20 411.49 412.73 413.44 T:isapa128v20 1358.54 1358.98 1359.42 T:isapk128v20 2325.95 2326.24 2500.00 T:isapxv20 7036.70 7038.56 7040.39 T:elephant176v2 8315.10 8316.63 8318.38 T:elephant160v2

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 6.36 6.39 6.45 T:aes128gcmv1 7.12 7.15 7.18 aes256gcmv1 11.85 12.18 12.54 ascon128av12 14.98 15.15 15.44 ascon128v12 15.20 15.47 15.90 ascon80pqv12 18.41 18.96 19.27 T:xoodyakround3 22.27 22.30 22.52 ascon128abi32v12 29.24 29.36 29.46 ascon128bi32v12 31.62 32.12 32.52 T:schwaemm256128v2 34.79 34.88 35.07 T:schwaemm256256v2 35.22? 35.30? 40.10? T:grain128aeadv2 36.06 36.30 36.60 T:schwaemm128128v2 38.77 38.90 38.94 romulusn 42.45 42.71 43.07 T:schwaemm192192v2 51.62 51.73 52.01 T:giftcofb128v1 52.73 52.88 53.24 romulusm 58.66 58.84 58.99 T:tinyjambu128v2 67.34 67.52 67.92 T:tinyjambu192v2 70.54 70.66 70.82 T:tinyjambu256v2 115.01 115.16 115.24 romulust 118.68 119.12 119.62 T:isapa128av20 157.32 157.62 157.95 T:elephant200v2 206.53 207.41 210.54 T:isapk128av20 412.58 412.90 413.90 T:isapa128v20 1358.61 1359.22 1359.98 T:isapk128v20 2327.59 2329.06 2500.14 T:isapxv20 7037.55 7039.24 7040.79 T:elephant176v2 8314.92 8316.34 8319.38 T:elephant160v2

Cycles/byte for 64+64 forgery 25% 50% 75% aead 6.35 6.37 6.39 T:aes128gcmv1 7.08 7.12 7.14 aes256gcmv1 11.82 11.93 12.11 ascon128av12 14.77 14.93 15.16 ascon128v12 15.07 15.14 15.27 ascon80pqv12 18.44 18.71 18.81 T:xoodyakround3 22.21 22.30 22.39 ascon128abi32v12 29.25 29.34 29.46 ascon128bi32v12 31.77 31.85 32.27 T:schwaemm256128v2 34.70 34.77 34.90 T:schwaemm256256v2 35.17 35.20 35.33 T:grain128aeadv2 36.20 36.23 36.43 T:schwaemm128128v2 38.72 38.77 38.93 romulusn 42.28 42.64 42.97 T:schwaemm192192v2 51.59 51.81 52.08 T:giftcofb128v1 52.74 52.84 52.90 romulusm 58.66 58.78 58.98 T:tinyjambu128v2 67.20 67.34 67.70 T:tinyjambu192v2 70.40 70.51 70.66 T:tinyjambu256v2 71.99 72.20 72.62 romulust 73.46 73.73 73.96 T:isapa128av20 130.12 130.77 133.72 T:isapk128av20 157.00 157.33 157.52 T:elephant200v2 214.64 215.03 215.50 T:isapa128v20 711.24 712.27 713.48 T:isapk128v20 1217.39 1218.16 1218.80 T:isapxv20 7037.72 7040.86 7042.05 T:elephant176v2 8316.54 8317.94 8319.12 T:elephant160v2