VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of NISTLWC cipher candidates on one machine: mipso32; Octeon II (cnmips64v2); 2011 Cavium Octeon II CN6120; 2 x 2000MHz; gcc23, supercop-20230530

[Page version: 20251103 11:56:58]

eBAEAD (ECRYPT Benchmarking of Authenticated Ciphers) is a project to measure the performance of authenticated ciphers. This page presents an excerpt of the full eBAEAD benchmark results. The excerpt is for NISTLWC, specifically (starting with supercop-20221005) finalists.

Each table row lists the first quartile of many speed measurements, the median of many speed measurements, the third quartile of many speed measurements, and the name of the primitive. Measurements with large variance are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each cipher and each implementation.

Test results

Graphs: (bytes,cycles)

Cycles/byte for long+0 encrypt 25% 50% 75% aead 50.01? 51.36? 61.39? ascon128abi32v12 63.02 64.37 66.14 ascon128av12 73.99 74.00 75.25 ascon128bi32v12 89.44 90.75 90.78 ascon128v12 90.74 90.75 90.76 ascon80pqv12 101.19 101.25 101.26 T:schwaemm256128v2 128.85 129.49 129.51 T:schwaemm128128v2 132.45 132.53 137.05 T:schwaemm192192v2 144.09 144.12 144.16 T:schwaemm256256v2 145.12 151.58 151.92 T:aes128gcmv1 171.96 174.74 175.10 T:aes256gcmv1 190.37 191.01 191.95 T:tinyjambu128v2 250.99 251.00 251.21 T:tinyjambu192v2 254.90 255.00 255.04 T:tinyjambu256v2 371.56 374.19 381.54 T:xoodyakround3 1078.00 1079.03 1081.98 T:giftcofb128v1 3277.23 3318.23 3339.11 T:romulusn 4844.57 4854.57 4873.24 T:romulusm 9617.11 9635.19 9643.22 T:romulust 106769.87 106853.87 106945.23 aes256gcmv1

Cycles/byte for long+0 decrypt 25% 50% 75% aead 50.25? 51.36? 56.47? ascon128abi32v12 64.22 65.56 69.86 ascon128av12 75.23 76.47 81.14 ascon128bi32v12 89.41 90.78 94.91 ascon80pqv12 90.72 91.89 94.85 ascon128v12 101.43 102.15 103.48 T:schwaemm256128v2 129.60 130.39 135.16 T:schwaemm128128v2 132.23 137.19 138.59 T:schwaemm192192v2 145.65 147.54 150.18 T:schwaemm256256v2 146.38 151.31 160.51 T:aes128gcmv1 173.77 174.30 181.81 T:aes256gcmv1 192.64 193.01 194.81 T:tinyjambu128v2 251.53 252.01 259.35 T:tinyjambu192v2 255.97 256.99 264.53 T:tinyjambu256v2 365.32 369.64 375.97 T:xoodyakround3 1075.86 1079.39 1092.87 T:giftcofb128v1 3294.78 3304.71 3317.58 T:romulusn 4875.54 4888.92 4895.09 T:romulusm 9619.08 9635.38 9640.70 T:romulust 106807.97 106908.10 107007.63 aes256gcmv1

Cycles/byte for long+0 forgery 25% 50% 75% aead 50.26? 51.45? 395.60? ascon128abi32v12 64.24 64.52 69.92 ascon128av12 75.25 76.38 81.16 ascon128bi32v12 90.74 90.77 94.85 ascon80pqv12 90.77 92.26 96.62 ascon128v12 101.37 101.47 103.36 T:schwaemm256128v2 129.61 130.38 135.49 T:schwaemm128128v2 133.01 137.20 140.47 T:schwaemm192192v2 146.28 147.55 150.06 T:schwaemm256256v2 151.04 151.32 160.39 T:aes128gcmv1 167.92 174.57 183.61 T:aes256gcmv1 192.99 193.81 194.77 T:tinyjambu128v2 251.95 252.01 259.49 T:tinyjambu192v2 256.86 257.90 264.49 T:tinyjambu256v2 366.67 370.01 376.51 T:xoodyakround3 1075.96 1079.13 1092.88 T:giftcofb128v1 3200.28 3202.41 3213.38 T:romulust 3294.93 3311.89 3369.35 T:romulusn 4877.49 4953.48 5022.97 T:romulusm 10879.40 10910.56 10938.64 aes256gcmv1

Cycles/byte for long+long encrypt 25% 50% 75% aead 49.60 49.62 49.64 ascon128abi32v12 59.60 60.24 60.29 ascon128av12 70.73 71.63 71.64 ascon128bi32v12 85.78 86.74 86.76 ascon128v12 86.74 86.75 86.76 ascon80pqv12 98.99 99.76 99.79 T:schwaemm256128v2 111.96 113.06 113.15 T:aes128gcmv1 121.88 124.57 124.92 T:aes256gcmv1 128.10 128.13 128.44 T:schwaemm128128v2 131.36 131.41 135.26 T:schwaemm192192v2 142.04 142.65 142.68 T:schwaemm256256v2 156.87 157.25 157.26 T:tinyjambu128v2 193.58 194.25 195.27 T:tinyjambu256v2 197.78 198.24 198.26 T:tinyjambu192v2 286.60 291.80 298.07 T:xoodyakround3 1076.77 1077.15 1083.59 T:giftcofb128v1 2459.08 2463.07 2464.93 T:romulusn 3235.72 3237.75 3240.99 T:romulusm 6415.61 6419.98 6425.17 T:romulust 58843.25 58873.21 58892.45 aes256gcmv1

Cycles/byte for long+long decrypt 25% 50% 75% aead 48.89 49.70 51.86 ascon128abi32v12 60.10 60.79 62.73 ascon128av12 72.20 72.26 75.04 ascon128bi32v12 86.74 86.75 89.10 ascon80pqv12 86.05 87.11 89.09 ascon128v12 99.84 99.88 101.21 T:schwaemm256128v2 110.99 112.83 120.74 T:aes128gcmv1 119.75 124.25 126.77 T:aes256gcmv1 127.64 128.18 132.34 T:schwaemm128128v2 131.54 135.33 136.07 T:schwaemm192192v2 145.55 146.18 147.09 T:schwaemm256256v2 157.98 158.25 159.04 T:tinyjambu128v2 195.23 195.25 196.01 T:tinyjambu256v2 198.03 198.50 199.22 T:tinyjambu192v2 281.86 289.20 290.06 T:xoodyakround3 1075.32 1077.47 1084.73 T:giftcofb128v1 2473.99 2479.06 2481.84 T:romulusn 3245.46 3250.19 3294.57 T:romulusm 6409.26 6418.96 6425.71 T:romulust 58847.96 58885.92 58961.56 aes256gcmv1

Cycles/byte for long+long forgery 25% 50% 75% aead 49.69 50.11 51.84 ascon128abi32v12 60.01 61.06 63.03 ascon128av12 72.24 72.26 74.96 ascon128bi32v12 86.74 86.75 89.06 ascon80pqv12 86.74 86.76 89.03 ascon128v12 99.47 99.87 101.17 T:schwaemm256128v2 111.18 112.82 115.17 T:aes128gcmv1 119.81 124.28 126.73 T:aes256gcmv1 128.14 128.19 132.33 T:schwaemm128128v2 131.28 131.90 135.71 T:schwaemm192192v2 142.25 145.97 146.39 T:schwaemm256256v2 157.75 158.25 158.95 T:tinyjambu128v2 194.80 195.24 195.99 T:tinyjambu256v2 198.41 198.50 199.17 T:tinyjambu192v2 287.08 289.48 290.82 T:xoodyakround3 1075.20 1077.29 1084.28 T:giftcofb128v1 2473.87 2474.90 2480.38 T:romulusn 3200.73 3206.20 3215.01 T:romulust 3249.89 3254.78 3317.31 T:romulusm 10882.04 10903.83 10934.19 aes256gcmv1

Cycles/byte for 0+long encrypt 25% 50% 75% aead 48.50? 50.39? 400.07? ascon128abi32v12 56.14? 57.63? 402.47? ascon128av12 69.31 74.17 75.19 T:aes128gcmv1 71.30 74.37 74.58 T:aes256gcmv1 70.30? 75.04? 79.12? ascon128bi32v12 82.73 82.76 86.67 ascon80pqv12 81.56 84.08 88.72 ascon128v12 98.30 99.42 106.04 T:schwaemm256128v2 123.51 123.51 123.53 T:tinyjambu128v2 126.74 126.75 126.76 T:schwaemm128128v2 127.45 130.25 134.25 T:schwaemm192192v2 133.49 133.50 133.52 T:tinyjambu256v2 140.48 141.18 141.23 T:schwaemm256256v2 145.49 145.50 145.52 T:tinyjambu192v2 201.09 203.62 203.64 T:xoodyakround3 1072.39 1074.62 1077.32 T:giftcofb128v1 1610.39 1612.55 1626.45 T:romulusm 1642.00 1655.62 1678.28 T:romulusn 3199.13 3214.06 3217.25 T:romulust 10882.86 10903.36 10911.27 aes256gcmv1

Cycles/byte for 0+long decrypt 25% 50% 75% aead 49.12 50.13 53.05 ascon128abi32v12 54.75? 57.61? 62.10? ascon128av12 70.43 72.37 77.74 ascon128bi32v12 71.64? 74.46? 80.19? T:aes256gcmv1 74.31? 74.99? 83.50? T:aes128gcmv1 82.76 84.05 88.52 ascon128v12 82.74 84.14 88.66 ascon80pqv12 98.28 99.33 104.05 T:schwaemm256128v2 123.28 124.56 129.34 T:tinyjambu128v2 126.74 127.67 132.55 T:schwaemm128128v2 129.33 134.24 136.62 T:schwaemm192192v2 133.27 134.49 135.21 T:tinyjambu256v2 144.47 144.49 145.63 T:schwaemm256256v2 144.98 145.77 150.78 T:tinyjambu192v2 201.46 203.21 206.99 T:xoodyakround3 1071.74 1074.97 1089.50 T:giftcofb128v1 1607.11 1613.23 1658.46 T:romulusm 1641.66 1658.95 1678.42 T:romulusn 3198.32 3200.25 3214.40 T:romulust 10879.36 10900.57 10918.78 aes256gcmv1

Cycles/byte for 0+long forgery 25% 50% 75% aead 49.12 49.18 50.74 ascon128abi32v12 56.03 57.55 62.03 ascon128av12 70.38 73.37 75.58 ascon128bi32v12 74.34 74.46 80.78 T:aes256gcmv1 73.16? 74.61? 83.37? T:aes128gcmv1 82.75 84.13 89.08 ascon128v12 82.77 85.69 88.57 ascon80pqv12 98.52 99.44 104.58 T:schwaemm256128v2 123.51 124.45 129.40 T:tinyjambu128v2 126.75 127.73 132.59 T:schwaemm128128v2 129.33 131.38 135.69 T:schwaemm192192v2 133.47 134.38 139.26 T:tinyjambu256v2 142.65 144.48 145.16 T:schwaemm256256v2 145.00 145.67 150.86 T:tinyjambu192v2 202.16 203.22 204.41 T:xoodyakround3 1071.83 1074.58 1075.71 T:giftcofb128v1 1607.27 1612.41 1626.55 T:romulusm 1642.45 1676.06 1687.60 T:romulusn 3197.96 3199.82 3209.45 T:romulust 10877.77 10906.06 10914.40 aes256gcmv1

Cycles/byte for 1536+1536 encrypt 25% 50% 75% aead 50.92 50.92 50.93 ascon128abi32v12 61.64 61.64 61.68 ascon128av12 72.93 72.93 72.95 ascon128bi32v12 88.10 88.10 88.12 ascon128v12 88.11 88.11 88.12 ascon80pqv12 102.81 102.81 102.82 T:schwaemm256128v2 120.49 120.50 120.56 T:aes128gcmv1 129.93 129.93 130.23 T:schwaemm128128v2 132.31 132.32 132.54 T:aes256gcmv1 134.79 134.79 135.10 T:schwaemm192192v2 146.61 146.61 146.62 T:schwaemm256256v2 158.71 158.71 158.72 T:tinyjambu128v2 195.92 195.92 195.94 T:tinyjambu256v2 199.93 199.93 199.94 T:tinyjambu192v2 291.49 294.65 294.87 T:xoodyakround3 1082.66 1082.68 1084.78 T:giftcofb128v1 2477.04 2477.52 2482.20 T:romulusn 3251.28 3253.86 3257.85 T:romulusm 6502.17 6502.65 6506.10 T:romulust 59946.82 59974.14 59995.01 aes256gcmv1

Cycles/byte for 1536+1536 decrypt 25% 50% 75% aead 51.01 51.88 54.69 ascon128abi32v12 61.55 62.25 65.13 ascon128av12 73.58 75.24 77.27 ascon128bi32v12 88.11 88.13 90.90 ascon128v12 88.14 88.15 90.95 ascon80pqv12 102.91 103.37 106.65 T:schwaemm256128v2 120.25 120.27 123.10 T:aes128gcmv1 129.98 129.99 131.47 T:schwaemm128128v2 132.06 132.07 135.07 T:aes256gcmv1 134.86 134.87 136.36 T:schwaemm192192v2 149.76 149.76 152.02 T:schwaemm256256v2 159.70 159.71 164.68 T:tinyjambu128v2 196.93 196.95 201.82 T:tinyjambu256v2 200.17 200.18 205.00 T:tinyjambu192v2 287.90 292.10 292.59 T:xoodyakround3 1082.68 1082.96 1091.02 T:giftcofb128v1 2492.26 2492.57 2497.44 T:romulusn 3262.73 3267.99 3273.38 T:romulusm 6501.86 6503.17 6513.19 T:romulust 59933.42 59985.55 60006.23 aes256gcmv1

Cycles/byte for 1536+1536 forgery 25% 50% 75% aead 51.01 51.54 53.56 ascon128abi32v12 61.55 61.57 64.58 ascon128av12 73.58 75.20 77.21 ascon128bi32v12 88.11 88.85 90.85 ascon128v12 88.14 88.90 90.94 ascon80pqv12 102.91 103.35 104.45 T:schwaemm256128v2 120.26 120.36 125.07 T:aes128gcmv1 129.98 129.99 131.42 T:schwaemm128128v2 132.06 132.10 136.44 T:aes256gcmv1 134.86 134.87 136.33 T:schwaemm192192v2 146.68 146.68 151.94 T:schwaemm256256v2 159.70 159.71 164.60 T:tinyjambu128v2 196.93 196.94 201.73 T:tinyjambu256v2 200.17 200.18 201.00 T:tinyjambu192v2 288.07 292.41 293.50 T:xoodyakround3 1082.68 1083.30 1092.10 T:giftcofb128v1 2492.38 2502.82 2537.54 T:romulusn 3263.25 3270.73 3353.10 T:romulusm 3284.81 3288.72 3291.41 T:romulust 11946.12 11963.39 11993.26 aes256gcmv1

Cycles/byte for 64+64 encrypt 25% 50% 75% aead 80.59 80.70 81.75 ascon128abi32v12 93.81 93.81 94.14 ascon128av12 102.86 102.94 103.75 ascon128bi32v12 119.23 119.27 119.39 ascon128v12 119.50 119.52 119.83 ascon80pqv12 171.50 171.61 172.19 T:schwaemm128128v2 172.23 172.23 172.80 T:schwaemm256128v2 192.09 192.09 192.38 T:tinyjambu128v2 224.30 229.53 243.47 T:schwaemm192192v2 234.44 234.44 234.84 T:tinyjambu256v2 237.27 237.73 256.05 T:schwaemm256256v2 238.48 238.59 238.69 T:tinyjambu192v2 291.67? 292.41? 376.78? T:aes128gcmv1 310.59 310.62 313.80 T:aes256gcmv1 425.80 433.92 465.47 T:xoodyakround3 1217.23 1217.45 1258.25 T:giftcofb128v1 2879.06 2879.22 3022.97 T:romulusn 3643.98 3644.50 3787.88 T:romulusm 8430.92 8431.20 8450.94 T:romulust 84153.20 84321.41 84802.55 aes256gcmv1

Cycles/byte for 64+64 decrypt 25% 50% 75% aead 81.12 81.23 81.52 ascon128abi32v12 94.11 94.11 94.70 ascon128av12 104.20 104.28 105.44 ascon128bi32v12 119.45? 119.61? 140.89? ascon128v12 120.12? 120.39? 148.17? ascon80pqv12 171.31 171.42 177.78 T:schwaemm128128v2 172.50 172.50 177.81 T:schwaemm256128v2 193.16 193.16 193.16 T:tinyjambu128v2 224.22 224.22 229.64 T:schwaemm192192v2 235.72 235.80 239.80 T:tinyjambu256v2 237.53 237.53 238.09 T:schwaemm256256v2 238.48 238.59 238.89 T:tinyjambu192v2 291.55? 293.89? 365.05? T:aes128gcmv1 310.22? 311.50? 353.22? T:aes256gcmv1 423.72 431.31 440.47 T:xoodyakround3 1217.72 1218.09 1266.95 T:giftcofb128v1 2896.41 2896.59 2952.95 T:romulusn 3653.75 3653.86 3796.91 T:romulusm 8431.47 8431.55 8454.30 T:romulust 84163.28 84295.81 84383.47 aes256gcmv1

Cycles/byte for 64+64 forgery 25% 50% 75% aead 81.12 81.22 81.77 ascon128abi32v12 94.11 94.11 95.03 ascon128av12 104.28? 104.28? 120.19? ascon128bi32v12 119.42 119.42 119.80 ascon128v12 120.02 120.12 120.12 ascon80pqv12 171.31 171.47 172.94 T:schwaemm128128v2 172.50 172.50 173.41 T:schwaemm256128v2 193.16 193.16 193.86 T:tinyjambu128v2 217.25 224.22 229.75 T:schwaemm192192v2 235.72 235.72 236.75 T:tinyjambu256v2 237.53 237.72 238.77 T:schwaemm256256v2 238.48 238.59 239.44 T:tinyjambu192v2 291.50? 291.81? 338.28? T:aes128gcmv1 310.27 310.59 311.67 T:aes256gcmv1 424.47 432.34 443.48 T:xoodyakround3 1217.59 1218.70 1265.88 T:giftcofb128v1 2891.14 2891.30 2947.17 T:romulusn 3652.83 3652.94 3796.53 T:romulusm 5218.84 5219.00 5242.23 T:romulust 36214.27 36225.98 36403.89 aes256gcmv1