VAMPIRE

eBACS: ECRYPT Benchmarking of Cryptographic Systems


ECRYPT II
General information:IntroductioneBASHeBASCeBAEADeBATSSUPERCOPXBXComputersArch
How to submit new software:Tipshashstreamaeaddhkemencryptsign
List of primitives measured:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
Measurements:lwcsha3hashstreamlwccaesaraeaddhkemencryptsign
List of subroutines:verifydecodeencodesortcorehashblocksxofscalarmult

Measurements of NISTLWC cipher candidates on one machine: amd64; Haswell+AES (306c3); 2013 Intel Xeon E3-1275 V3; 4 x 3500MHz; titan0, supercop-20240909

[Page version: 20240912 11:46:31]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.


Test results

Graphs: (bytes,cycles)
Cycles/byte for long+0 encrypt
25%50%75%aead
1.021.071.11T:aes128gcmv1
1.23?1.33?1.38?T:aes256gcmv1
7.187.217.23ascon128av12
10.5810.6010.63ascon128v12
10.5910.6110.64ascon80pqv12
14.3014.3314.36ascon128abi32v12
17.6117.6917.77T:xoodyakround3
19.2619.2919.36T:schwaemm256128v2
21.7521.7921.81ascon128bi32v12
23.6923.7223.75T:schwaemm256256v2
25.2725.3725.44T:schwaemm192192v2
27.1527.2027.40T:grain128aeadv2
28.0128.0628.08T:schwaemm128128v2
39.2139.5339.60romulusn
40.7240.9241.02T:isapa128av20
40.7641.0441.35T:isapa128v20
41.5941.6441.66T:giftcofb128v1
61.5261.6061.94T:tinyjambu128v2
63.5363.6163.78romulusm
71.6971.7972.01T:isapk128av20
74.1274.1874.23T:tinyjambu192v2
82.3182.3282.32T:tinyjambu256v2
95.1295.3395.62T:isapk128v20
124.97125.05125.46romulust
159.20159.39159.70T:elephant200v2
188.18190.36192.97T:isapxv20
281.09?291.22?420.85?aes256gcmv1
7184.167187.917190.78T:elephant176v2
8737.588738.358739.02T:elephant160v2
Cycles/byte for long+0 decrypt
25%50%75%aead
0.94?1.03?1.08?T:aes128gcmv1
1.19?1.30?1.38?T:aes256gcmv1
7.137.177.18ascon128av12
10.3810.5810.63ascon128v12
10.5910.6210.69ascon80pqv12
14.4114.4414.49ascon128abi32v12
17.1717.2117.25T:xoodyakround3
19.2219.2619.34T:schwaemm256128v2
21.3721.4021.69ascon128bi32v12
23.6923.7223.75T:schwaemm256256v2
26.0526.0926.14T:schwaemm192192v2
28.0128.0528.11T:schwaemm128128v2
28.2828.3128.33T:grain128aeadv2
39.5039.5439.57romulusn
40.7940.8741.28T:isapa128v20
40.9040.9941.07T:isapa128av20
41.6441.7041.74T:giftcofb128v1
61.3661.4461.95T:tinyjambu128v2
63.5263.5563.67romulusm
71.5471.7571.94T:isapk128av20
74.1574.1974.23T:tinyjambu192v2
82.2882.3082.31T:tinyjambu256v2
95.0395.3795.52T:isapk128v20
125.06125.19125.55romulust
159.10159.54159.83T:elephant200v2
185.07?190.98?226.59?T:isapxv20
290.08290.42290.61aes256gcmv1
7183.427186.937188.43T:elephant176v2
8736.718737.948738.68T:elephant160v2
Cycles/byte for long+0 forgery
25%50%75%aead
0.95?1.03?1.09?T:aes128gcmv1
1.201.271.32T:aes256gcmv1
7.137.167.18ascon128av12
10.3910.5710.63ascon128v12
10.6010.6310.66ascon80pqv12
14.4114.4514.48ascon128abi32v12
17.2017.3117.34T:xoodyakround3
19.2319.2719.31T:schwaemm256128v2
19.9920.0720.40T:isapa128v20
21.3821.4121.62ascon128bi32v12
23.7023.7223.75T:schwaemm256256v2
26.0226.1126.15T:schwaemm192192v2
27.9928.0428.10T:isapa128av20
28.0228.0728.09T:schwaemm128128v2
28.2528.2828.29T:grain128aeadv2
39.5139.5339.56romulusn
41.6541.6941.73T:giftcofb128v1
42.7742.8542.91romulust
47.5047.6647.80T:isapk128av20
59.3059.5259.67T:isapk128v20
61.3961.5061.96T:tinyjambu128v2
63.4963.5163.69romulusm
74.1474.2274.28T:tinyjambu192v2
82.2982.3182.33T:tinyjambu256v2
108.81?113.43?148.29?T:isapxv20
159.22159.51159.96T:elephant200v2
278.60278.71279.14aes256gcmv1
7184.027185.577191.85T:elephant176v2
8737.468738.458739.46T:elephant160v2
Cycles/byte for long+long encrypt
25%50%75%aead
0.730.750.78T:aes128gcmv1
0.860.880.89T:aes256gcmv1
7.167.187.19ascon128av12
10.6010.6110.62ascon128v12
10.6410.6710.68ascon80pqv12
13.3313.3813.43T:xoodyakround3
14.4014.4814.51ascon128abi32v12
19.1019.1419.16T:schwaemm256128v2
21.4321.6121.64ascon128bi32v12
23.5923.6023.61T:schwaemm256256v2
25.1325.1725.25T:schwaemm192192v2
27.2027.2627.33T:grain128aeadv2
27.8427.8627.94T:schwaemm128128v2
30.2430.4130.62T:isapa128v20
31.5931.7032.01romulusn
34.4634.4934.51T:isapa128av20
41.5341.5741.59T:giftcofb128v1
43.6843.7343.79romulusm
50.6450.6850.78T:tinyjambu128v2
58.1358.1658.25T:tinyjambu192v2
59.5959.6859.74T:isapk128av20
62.1662.1762.19T:tinyjambu256v2
77.2777.5077.71T:isapk128v20
83.7583.8283.98romulust
119.73119.95120.13T:elephant200v2
150.49151.35152.58T:isapxv20
276.43?285.65?414.64?aes256gcmv1
5364.185365.555366.00T:elephant176v2
6553.626554.026555.04T:elephant160v2
Cycles/byte for long+long decrypt
25%50%75%aead
0.700.720.76T:aes128gcmv1
0.820.840.88T:aes256gcmv1
7.157.177.19ascon128av12
10.5010.5210.53ascon128v12
10.6010.6110.65ascon80pqv12
13.1113.1413.16T:xoodyakround3
14.3914.4514.48ascon128abi32v12
19.0719.1119.15T:schwaemm256128v2
21.5821.7021.73ascon128bi32v12
23.5923.6123.64T:schwaemm256256v2
25.4725.5325.63T:schwaemm192192v2
27.7727.8027.81T:grain128aeadv2
27.8627.8827.92T:schwaemm128128v2
30.4430.5930.77T:isapa128v20
31.7531.8132.17romulusn
34.4634.5234.55T:isapa128av20
41.5641.5941.61T:giftcofb128v1
43.7543.8043.85romulusm
50.5750.6951.00T:tinyjambu128v2
58.1358.1758.23T:tinyjambu192v2
59.5459.6859.83T:isapk128av20
62.1662.1662.18T:tinyjambu256v2
77.3177.4977.74T:isapk128v20
83.7383.8283.99romulust
119.56119.80120.06T:elephant200v2
147.48?151.67?185.96?T:isapxv20
284.34284.50284.85aes256gcmv1
5364.155365.435366.43T:elephant176v2
6553.806554.326555.10T:elephant160v2
Cycles/byte for long+long forgery
25%50%75%aead
0.700.720.75T:aes128gcmv1
0.840.860.87T:aes256gcmv1
7.157.167.18ascon128av12
10.4910.5310.55ascon128v12
10.6010.6110.67ascon80pqv12
13.1213.1513.20T:xoodyakround3
14.3914.4414.48ascon128abi32v12
19.1019.1319.14T:schwaemm256128v2
19.9820.0920.20T:isapa128v20
21.5521.6221.71ascon128bi32v12
23.5923.6023.63T:schwaemm256256v2
25.4725.5425.65T:schwaemm192192v2
27.7827.7927.80T:grain128aeadv2
27.8527.8827.91T:schwaemm128128v2
28.0228.0428.06T:isapa128av20
31.7031.8032.17romulusn
41.5641.5841.60T:giftcofb128v1
42.6442.7142.74romulust
43.7943.8643.89romulusm
47.5647.6547.74T:isapk128av20
50.4850.6250.99T:tinyjambu128v2
58.1358.1958.24T:tinyjambu192v2
59.4559.5559.65T:isapk128v20
62.1662.1762.18T:tinyjambu256v2
109.56?113.04?146.76?T:isapxv20
119.62119.76119.99T:elephant200v2
278.63278.80278.87aes256gcmv1
5364.105365.045366.49T:elephant176v2
6554.056554.766555.60T:elephant160v2
Cycles/byte for 0+long encrypt
25%50%75%aead
0.37?0.42?0.46?T:aes128gcmv1
0.38?0.42?0.46?T:aes256gcmv1
7.097.117.14ascon128av12
9.039.069.08T:xoodyakround3
10.5810.6010.64ascon80pqv12
10.5910.6310.64ascon128v12
14.3914.4214.43ascon128abi32v12
18.9018.9318.97T:schwaemm256128v2
19.6919.9820.37T:isapa128v20
21.4121.4321.46ascon128bi32v12
23.4523.5123.53T:schwaemm256256v2
23.8523.9424.07romulusm
23.8724.0624.80romulusn
24.9325.0225.08T:schwaemm192192v2
27.2327.2427.27T:grain128aeadv2
27.6327.6727.68T:schwaemm128128v2
28.0028.0628.10T:isapa128av20
39.6539.8239.88T:tinyjambu128v2
41.4241.4541.49T:giftcofb128v1
42.0842.0942.11T:tinyjambu256v2
42.2042.3442.40T:tinyjambu192v2
42.4842.5442.63romulust
47.5147.6247.76T:isapk128av20
59.3159.5859.82T:isapk128v20
80.2880.6681.16T:elephant200v2
111.51112.34113.89T:isapxv20
269.69?278.83?409.56?aes256gcmv1
3545.483546.953549.33T:elephant176v2
4371.354372.254373.67T:elephant160v2
Cycles/byte for 0+long decrypt
25%50%75%aead
0.37?0.41?0.48?T:aes256gcmv1
0.39?0.42?0.45?T:aes128gcmv1
7.167.187.19ascon128av12
9.009.039.07T:xoodyakround3
10.4510.4810.50ascon128v12
10.5810.5910.62ascon80pqv12
14.3814.4114.43ascon128abi32v12
18.9018.9418.99T:schwaemm256128v2
19.6620.3020.36T:isapa128v20
21.7321.7521.77ascon128bi32v12
23.4323.4823.53T:schwaemm256256v2
23.8924.0224.06romulusm
23.9124.0524.82romulusn
24.9425.0025.09T:schwaemm192192v2
27.2427.2727.30T:grain128aeadv2
27.6627.7027.76T:schwaemm128128v2
28.0128.0528.08T:isapa128av20
39.8239.8839.96T:tinyjambu128v2
41.4241.4841.50T:giftcofb128v1
42.0642.0742.08T:tinyjambu256v2
42.1942.2942.34T:tinyjambu192v2
42.4542.5342.55romulust
47.4947.6447.79T:isapk128av20
59.3459.5159.97T:isapk128v20
80.2880.6881.09T:elephant200v2
107.90?112.65?147.74?T:isapxv20
278.89279.21279.99aes256gcmv1
3545.713546.783548.29T:elephant176v2
4371.274371.604373.80T:elephant160v2
Cycles/byte for 0+long forgery
25%50%75%aead
0.39?0.42?0.45?T:aes256gcmv1
0.39?0.42?0.44?T:aes128gcmv1
7.157.167.19ascon128av12
9.029.059.08T:xoodyakround3
10.4610.4710.51ascon128v12
10.6110.6210.63ascon80pqv12
14.3814.4114.43ascon128abi32v12
18.8818.9218.95T:schwaemm256128v2
19.9320.1720.35T:isapa128v20
21.6821.7221.73ascon128bi32v12
23.4723.5023.54T:schwaemm256256v2
23.9124.0224.05romulusm
23.9424.0624.81romulusn
24.9325.0125.07T:schwaemm192192v2
27.2427.2827.31T:grain128aeadv2
27.6327.6627.69T:schwaemm128128v2
28.0428.0828.11T:isapa128av20
39.8139.8540.03T:tinyjambu128v2
41.4341.4841.50T:giftcofb128v1
42.0542.0742.08T:tinyjambu256v2
42.1342.2942.31T:tinyjambu192v2
42.5042.5542.59romulust
47.5547.7347.80T:isapk128av20
59.4059.5559.78T:isapk128v20
80.2880.5480.86T:elephant200v2
107.90?112.63?147.71?T:isapxv20
278.66278.88279.18aes256gcmv1
3545.713546.713547.97T:elephant176v2
4371.194371.674373.29T:elephant160v2
Cycles/byte for 1536+1536 encrypt
25%50%75%aead
1.931.941.94T:aes128gcmv1
2.082.082.09T:aes256gcmv1
7.347.347.36ascon128av12
10.7610.7810.79ascon128v12
10.8210.8310.84ascon80pqv12
13.4913.5213.55T:xoodyakround3
14.7314.8214.82ascon128abi32v12
19.6819.7119.74T:schwaemm256128v2
21.7821.9121.93ascon128bi32v12
24.2324.2524.27T:schwaemm256256v2
25.7125.7425.79T:schwaemm192192v2
27.7227.7427.75T:grain128aeadv2
28.2428.2628.28T:schwaemm128128v2
31.9232.0232.28romulusn
37.0237.0437.07T:isapa128av20
41.9141.9341.95T:giftcofb128v1
43.9143.9844.08romulusm
44.3344.3744.51T:isapa128v20
51.0951.1451.16T:tinyjambu128v2
58.6058.6258.68T:tinyjambu192v2
62.6562.6562.66T:tinyjambu256v2
66.9467.0267.07T:isapk128av20
85.0685.1185.30romulust
122.39122.42122.48T:elephant200v2
133.63133.77133.94T:isapk128v20
248.37249.69249.72T:isapxv20
286.24?287.20?408.31?aes256gcmv1
5405.595405.905407.99T:elephant176v2
6628.116628.276628.91T:elephant160v2
Cycles/byte for 1536+1536 decrypt
25%50%75%aead
1.921.931.95T:aes128gcmv1
2.072.092.10T:aes256gcmv1
7.347.357.36ascon128av12
10.6710.6710.69ascon128v12
10.7810.8010.82ascon80pqv12
13.2813.2913.31T:xoodyakround3
14.7514.7714.78ascon128abi32v12
19.6619.6819.73T:schwaemm256128v2
21.8821.9822.03ascon128bi32v12
24.2324.2624.29T:schwaemm256256v2
26.0426.1226.17T:schwaemm192192v2
28.2228.2328.24T:grain128aeadv2
28.2628.2728.30T:schwaemm128128v2
32.0032.1132.44romulusn
37.0337.0637.09T:isapa128av20
41.9241.9441.97T:giftcofb128v1
44.1244.1844.21romulusm
44.2644.5044.54T:isapa128v20
50.9951.0451.34T:tinyjambu128v2
58.6058.6658.69T:tinyjambu192v2
62.6562.6562.66T:tinyjambu256v2
67.0267.0567.22T:isapk128av20
85.0685.1885.25romulust
122.36122.48122.62T:elephant200v2
133.78133.82134.04T:isapk128v20
248.14?249.77?281.20?T:isapxv20
286.11286.14286.44aes256gcmv1
5405.435405.705406.64T:elephant176v2
6627.906628.576629.58T:elephant160v2
Cycles/byte for 1536+1536 forgery
25%50%75%aead
1.911.921.93T:aes128gcmv1
2.062.072.09T:aes256gcmv1
7.347.347.36ascon128av12
10.6710.6810.70ascon128v12
10.7910.8010.83ascon80pqv12
13.2913.3113.33T:xoodyakround3
14.7514.7614.78ascon128abi32v12
19.6719.6919.74T:schwaemm256128v2
21.9122.0122.01ascon128bi32v12
24.2224.2524.28T:schwaemm256256v2
26.0626.1026.16T:schwaemm192192v2
27.2127.2327.25T:isapa128v20
28.2028.2228.24T:grain128aeadv2
28.2428.2528.28T:schwaemm128128v2
29.4829.5029.51T:isapa128av20
32.0232.1132.42romulusn
41.9641.9741.98T:giftcofb128v1
43.8943.9243.94romulust
44.1444.2044.25romulusm
50.8451.0651.37T:tinyjambu128v2
51.9752.0152.13T:isapk128av20
58.6258.6858.71T:tinyjambu192v2
62.6562.6562.67T:tinyjambu256v2
88.3488.4288.57T:isapk128v20
122.30122.45122.61T:elephant200v2
162.30?163.26?194.65?T:isapxv20
280.55281.30281.40aes256gcmv1
5405.605406.375407.40T:elephant176v2
6628.096628.816629.57T:elephant160v2
Cycles/byte for 64+64 encrypt
25%50%75%aead
11.3011.5211.66ascon128av12
14.4214.4214.55ascon128v12
14.5414.6114.91ascon80pqv12
19.5519.7120.02T:xoodyakround3
22.0122.0922.45ascon128abi32v12
28.7028.8629.38ascon128bi32v12
29.8830.0330.59T:aes128gcmv1
30.8831.2131.43T:aes256gcmv1
32.2032.3032.61T:schwaemm256128v2
36.1336.2836.66T:schwaemm128128v2
37.0937.1237.16T:grain128aeadv2
38.5338.7038.88romulusn
38.6938.8839.01T:schwaemm256256v2
41.5241.8642.22T:schwaemm192192v2
50.0550.1250.26T:giftcofb128v1
50.5850.7350.91romulusm
60.2360.4560.70T:tinyjambu128v2
68.8469.0269.17T:tinyjambu192v2
73.3473.7374.00T:tinyjambu256v2
94.3894.5995.48T:isapa128av20
113.80114.18114.59romulust
173.66175.27175.98T:elephant200v2
219.77220.20221.42T:isapk128av20
323.78?325.02?461.46?aes256gcmv1
361.23365.40366.68T:isapa128v20
1405.041406.361407.14T:isapk128v20
2445.772482.972484.08T:isapxv20
6732.436736.706762.88T:elephant176v2
8878.788880.798882.33T:elephant160v2
Cycles/byte for 64+64 decrypt
25%50%75%aead
11.4111.4411.55ascon128av12
14.3114.3614.62ascon128v12
14.5614.7214.91ascon80pqv12
19.4819.6220.09T:xoodyakround3
21.9922.0622.51ascon128abi32v12
28.7928.8429.39ascon128bi32v12
29.4829.8130.07T:aes128gcmv1
30.4930.8131.31T:aes256gcmv1
32.0532.1632.49T:schwaemm256128v2
36.1736.4336.67T:schwaemm128128v2
37.6137.6537.69T:grain128aeadv2
38.8538.9138.97T:schwaemm256256v2
38.8038.9439.34romulusn
41.8942.0542.21T:schwaemm192192v2
50.1250.2050.55T:giftcofb128v1
52.2552.4552.64romulusm
60.1260.5260.76T:tinyjambu128v2
68.8868.9869.31T:tinyjambu192v2
73.4173.5973.75T:tinyjambu256v2
94.3494.8795.03T:isapa128av20
114.00114.22114.99romulust
174.05174.41174.86T:elephant200v2
219.27220.57221.90T:isapk128av20
324.16325.14325.69aes256gcmv1
364.81365.90366.34T:isapa128v20
1404.991407.181408.33T:isapk128v20
2445.292478.912527.99T:isapxv20
6732.486735.006747.13T:elephant176v2
8878.678880.158881.45T:elephant160v2
Cycles/byte for 64+64 forgery
25%50%75%aead
11.3311.4211.63ascon128av12
14.2714.2914.43ascon128v12
14.6014.7214.81ascon80pqv12
19.4819.7319.98T:xoodyakround3
21.9922.0522.20ascon128abi32v12
28.8128.9429.02ascon128bi32v12
29.4129.6229.77T:aes128gcmv1
30.1830.3530.72T:aes256gcmv1
32.0532.1232.24T:schwaemm256128v2
36.0336.1636.44T:schwaemm128128v2
37.5937.6337.72T:grain128aeadv2
38.5938.7339.13romulusn
38.7438.8038.96T:schwaemm256256v2
41.8742.1642.31T:schwaemm192192v2
50.0850.1850.27T:giftcofb128v1
52.3052.4652.67romulusm
59.9960.3760.74T:tinyjambu128v2
62.1862.2962.53T:isapa128av20
68.8169.0869.15T:tinyjambu192v2
71.8472.0072.33romulust
73.4473.4773.55T:tinyjambu256v2
138.56139.12140.51T:isapk128av20
173.13173.86175.77T:elephant200v2
187.83188.09188.60T:isapa128v20
318.96319.17319.80aes256gcmv1
735.80737.23738.88T:isapk128v20
1279.921297.161342.68T:isapxv20
6732.236734.286737.73T:elephant176v2
8879.058880.958882.34T:elephant160v2