VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

General information:	Introduction	eBASH	eBASC	eBAEAD	eBATS	SUPERCOP	XBX	Computers	Arch

How to submit new software:	Tips	hash	stream	aead	dh	kem	encrypt	sign

List of primitives measured:	lwc	sha3	hash	stream	lwc	caesar	aead	dh	kem	encrypt	sign

Measurements:	lwc	sha3	hash	stream	lwc	caesar	aead	dh	kem	encrypt	sign

List of subroutines:	verify	decode	encode	sort	core	hashblocks	xof	scalarmult

Measurements of stream ciphers on one machine: amd64; Ivy Bridge+AES (306a9); 2012 Intel Xeon E3-1275 V2; 4 x 3500MHz; `hydra8`, `supercop-20260217`

[Page version: 20260315 18:26:26]

eBASC (ECRYPT Benchmarking of Stream Ciphers) is a project to measure the performance of stream ciphers. This page presents benchmark results collected in eBASC:

Speed (cycles/byte) of encrypting an 8-byte message.
Speed of encrypting a 64-byte message.
Speed of encrypting a 576-byte message.
Speed of encrypting a 1536-byte message.
Speed of encrypting a 4096-byte message.
Speed of encrypting a long message. This is computed as 1/3072 of the difference in cycle counts between encrypting 4096-byte messages and encrypting 1024-byte messages.

Graphs show timings for all message lengths between 0 and 4096 bytes. The stair-step shape of a typical curve on the graphs reflects the fact that these stream ciphers handle messages in blocks, such as 64-byte blocks.

Each table row lists the first quartile of many speed measurements (or StQ1 starting with supercop-20260214), the median of many speed measurements (or StQ2 starting with supercop-20260214), the third quartile of many speed measurements (or StQ3 starting with supercop-20260214), and the name of the primitive. Measurements with large interquartile range (or stabilized interquartile range) are indicated in red with question marks. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each stream cipher and each implementation. Designers and implementors interested in submitting new stream ciphers and new implementations should read the call for submissions.

Test results

Graphs: old (bytes,cycles)

Cycles/byte for long messages

25% 50% 75% stream

0.92 0.93 0.94 T:aes128ctr

0.95 0.96 0.96 tango642

1.03 1.04 1.05 chacha8

1.20 1.21 1.22 aes256ctr

1.23 1.23 1.24 salsa208

1.47 1.49 1.50 chacha12

1.50 1.53 1.57 T:aes192ctr

1.63 1.63 1.64 T:trivium

1.74 1.75 1.75 salsa2012

1.89 1.97 2.01 T:tpy

2.07 2.07 2.08 T:speck6496ctr

2.07 2.09 2.13 T:hc128

2.14 2.14 2.15 T:speck64128ctr

2.28 2.30 2.32 T:sosemanuk

2.32 2.33 2.34 T:nlsv2

2.32 2.34 2.36 chacha20

2.31 2.42 2.52 T:tpy6

2.45 2.47 2.48 T:cryptmtv3

2.63 2.65 2.66 T:speck128128ctr

2.72 2.72 2.73 T:speck128192ctr

2.79 2.80 2.81 T:speck128256ctr

2.81 2.82 2.83 salsa20

2.81 2.82 2.83 xsalsa20

2.98 2.98 2.99 T:simon6496ctr

3.06 3.08 3.11 T:hc256

2.95 3.09 3.15 T:tpypy

3.09 3.10 3.11 T:simon64128ctr

3.50 3.51 3.52 T:snow20

3.48 3.53 3.57 T:panama

3.60 3.62 3.63 T:rabbit

4.52 4.54 4.55 T:simon128128ctr

4.90 4.91 4.92 T:lexv2

5.40 5.46 5.47 T:simon128256ctr

9.71 9.74 9.77 T:aes128estream

15.45 15.47 15.50 T:aes256estream

21.05 21.12 21.24 T:ocelot1

21.99 22.08 22.21 T:ocelot2

36.46 38.22 38.88 T:amastrid

Cycles/byte for 4096 bytes

25% 50% 75% stream

0.96 0.97 0.97 T:aes128ctr

1.06 1.07 1.07 chacha8

1.13 1.13 1.13 tango642

1.26 1.26 1.26 aes256ctr

1.26 1.26 1.26 salsa208

1.50 1.51 1.52 chacha12

1.72 1.72 1.72 T:trivium

1.77 1.77 1.78 salsa2012

1.93 1.94 1.96 T:aes192ctr

2.11 2.11 2.12 T:speck6496ctr

2.19 2.19 2.19 T:speck64128ctr

2.35 2.36 2.37 chacha20

2.48 2.48 2.49 T:nlsv2

2.69 2.69 2.70 T:speck128128ctr

2.77 2.77 2.77 T:speck128192ctr

2.84 2.85 2.85 salsa20

2.84 2.85 2.85 T:speck128256ctr

2.87 2.88 2.89 T:sosemanuk

2.94 2.94 2.95 T:cryptmtv3

2.97 2.97 2.98 xsalsa20

3.10 3.12 3.16 T:tpy6

3.19 3.20 3.20 T:simon6496ctr

3.44 3.45 3.45 T:simon64128ctr

3.62 3.62 3.63 T:snow20

3.64 3.65 3.66 T:tpy

3.71 3.72 3.72 T:rabbit

4.61 4.64 4.65 T:panama

4.63 4.65 4.68 T:tpypy

4.84 4.85 4.86 T:simon128128ctr

5.06 5.07 5.07 T:lexv2

5.45 5.45 5.48 T:hc128

5.88 5.88 5.89 T:simon128256ctr

9.80 9.81 9.82 T:aes128estream

12.25 12.25 12.26 T:hc256

15.56 15.57 15.58 T:aes256estream

22.58 22.62 22.67 T:ocelot1

23.21 23.25 23.32 T:ocelot2

38.28 39.35 39.82 T:amastrid

Cycles/byte for 1536 bytes

25% 50% 75% stream

1.07 1.07 1.08 T:aes128ctr

1.10 1.11 1.13 chacha8

1.29 1.30 1.31 salsa208

1.37 1.38 1.40 aes256ctr

1.41 1.42 1.43 tango642

1.53 1.54 1.55 chacha12

1.81 1.82 1.82 salsa2012

1.87 1.87 1.88 T:trivium

2.19 2.19 2.22 T:speck6496ctr

2.26 2.26 2.28 T:speck64128ctr

2.39 2.40 2.41 chacha20

2.59 2.63 2.71 T:aes192ctr

2.76 2.77 2.78 T:speck128128ctr

2.81 2.82 2.83 T:nlsv2

2.82 2.84 2.85 T:speck128192ctr

2.89 2.89 2.90 salsa20

2.91 2.92 2.93 T:speck128256ctr

3.21 3.22 3.23 xsalsa20

3.55 3.55 3.56 T:simon6496ctr

3.79 3.80 3.81 T:snow20

3.87 3.88 3.89 T:rabbit

3.89 3.91 3.92 T:sosemanuk

4.03 4.04 4.07 T:simon64128ctr

4.25 4.27 4.35 T:tpy6

4.27 4.28 4.29 T:cryptmtv3

5.33 5.35 5.36 T:lexv2

5.36 5.37 5.38 T:simon128128ctr

6.40 6.44 6.47 T:tpy

6.45 6.48 6.51 T:panama

6.59 6.60 6.61 T:simon128256ctr

7.22 7.24 7.30 T:tpypy

9.91 9.92 9.94 T:aes128estream

11.07 11.08 11.12 T:hc128

15.70 15.72 15.76 T:aes256estream

24.94 25.01 25.07 T:ocelot1

25.12 25.22 25.37 T:ocelot2

27.51 27.54 27.58 T:hc256

40.47 40.77 41.05 T:amastrid

Cycles/byte for 576 bytes

25% 50% 75% stream

1.30 1.32 1.39 T:aes128ctr

1.31 1.32 1.34 chacha8

1.57 1.58 1.59 salsa208

1.70 1.72 1.75 aes256ctr

1.78 1.79 1.81 chacha12

2.14 2.15 2.16 salsa2012

2.20 2.21 2.24 tango642

2.24 2.24 2.29 T:trivium

2.40 2.41 2.42 T:speck6496ctr

2.49 2.49 2.51 T:speck64128ctr

2.76 2.78 2.81 chacha20

2.98 3.00 3.04 T:speck128128ctr

3.06 3.07 3.13 T:speck128192ctr

3.16 3.17 3.19 T:speck128256ctr

3.34 3.35 3.37 salsa20

3.62 3.64 3.65 T:nlsv2

4.17 4.20 4.24 xsalsa20

4.22 4.24 4.26 T:snow20

4.31 4.33 4.35 T:rabbit

4.36 4.41 4.68 T:aes192ctr

4.78 4.80 4.83 T:cryptmtv3

5.20 5.21 5.23 T:simon6496ctr

6.04 6.06 6.08 T:lexv2

6.63 6.65 6.68 T:sosemanuk

7.24? 7.31? 8.61? T:simon64128ctr

7.24 7.34 7.44 T:tpy6

9.39 9.40 9.59 T:simon128256ctr

9.28? 9.51? 10.74? T:simon128128ctr

10.19 10.22 10.26 T:aes128estream

11.30 11.39 11.46 T:panama

13.56 13.62 13.69 T:tpy

14.13 14.32 14.38 T:tpypy

16.08 16.13 16.17 T:aes256estream

26.08 26.12 26.21 T:hc128

30.15 30.34 30.52 T:ocelot2

31.20 31.35 31.51 T:ocelot1

47.55 47.76 48.10 T:amastrid

68.13 68.22 68.34 T:hc256

Cycles/byte for 64 bytes

25% 50% 75% stream

3.17 3.20 3.23 chacha8

3.98 4.01 4.07 salsa208

4.22 4.23 4.26 chacha12

4.47 4.65 4.80 T:aes128ctr

5.05 5.12 5.27 T:speck64128ctr

5.16 5.19 5.21 salsa2012

5.03 5.21 5.31 T:speck6496ctr

5.51 5.73 5.90 aes256ctr

5.75 5.83 5.91 T:speck128128ctr

5.92 6.01 6.04 T:speck128192ctr

6.05 6.09 6.09 T:speck128256ctr

6.23 6.26 6.34 chacha20

7.12 7.16 7.25 T:trivium

7.40 7.46 7.53 salsa20

9.36 9.48 9.67 T:rabbit

9.87 9.95 10.04 T:snow20

10.09 10.27 10.38 T:simon6496ctr

11.62 11.79 11.88 T:simon64128ctr

12.14 12.17 12.26 T:cryptmtv3

12.25 12.36 12.59 tango642

14.29 14.31 14.37 T:aes128estream

14.76 14.98 15.21 xsalsa20

15.05 15.20 15.64 T:lexv2

16.08 16.17 16.31 T:nlsv2

16.13 16.23 16.25 T:simon128128ctr

16.55 16.55 16.55 T:simon128256ctr

21.44 21.58 21.66 T:aes256estream

27.17 27.44 28.02 T:aes192ctr

37.86 37.98 38.23 T:sosemanuk

45.90 46.68 47.98 T:tpy6

73.12 73.72 74.20 T:panama

93.99 96.07 97.82 T:ocelot2

102.64 103.64 104.51 T:tpypy

107.94 108.52 109.12 T:tpy

113.83 114.93 115.51 T:ocelot1

135.31 135.91 137.20 T:amastrid

217.36 217.58 218.38 T:hc128

589.41 589.80 590.23 T:hc256

Cycles/byte for 8 bytes

25% 50% 75% stream

21.83 21.95 23.78 T:speck6496ctr

22.88 23.05 23.29 T:speck64128ctr

26.25 26.46 26.75 T:speck128256ctr

25.57 26.47 27.93 T:speck128192ctr

26.84 27.10 27.61 chacha8

31.20 31.27 32.17 T:speck128128ctr

34.95 35.17 35.47 chacha12

36.11 37.35 39.41 T:aes128ctr

44.75 45.04 45.81 T:trivium

44.51 46.22 47.96 aes256ctr

49.60 49.82 50.19 salsa208

51.25 51.54 52.48 chacha20

54.00 54.66 56.08 T:simon6496ctr

55.15 56.54 58.33 T:rabbit

59.68 60.38 61.18 salsa2012

64.42 64.71 65.23 T:aes128estream

64.66 65.00 65.62 T:simon64128ctr

77.01 77.32 78.27 T:snow20

77.42 77.82 78.24 T:aes256estream

78.02 78.55 79.28 T:cryptmtv3

80.82 81.64 82.02 salsa20

84.95 85.58 86.18 T:nlsv2

85.05 86.72 86.97 T:simon128128ctr

90.74 91.51 92.98 T:lexv2

91.68 92.83 95.49 tango642

105.05 105.46 107.29 T:simon128256ctr

139.98 141.55 143.16 xsalsa20

213.38 214.77 219.45 T:aes192ctr

302.77 304.09 305.83 T:sosemanuk

351.44 363.52 366.70 T:tpy6

574.55 578.71 583.28 T:panama

605.07 611.72 617.42 T:ocelot2

735.65 757.05 769.58 T:ocelot1

788.62 816.11 821.88 T:tpypy

852.93 861.23 869.65 T:tpy

882.17 886.99 894.47 T:amastrid

1736.68 1738.60 1744.70 T:hc128

4712.09 4717.97 4727.11 T:hc256

eBACS: ECRYPT Benchmarking of Cryptographic Systems

Measurements of stream ciphers on one machine: amd64; Ivy Bridge+AES (306a9); 2012 Intel Xeon E3-1275 V2; 4 x 3500MHz; hydra8, supercop-20260217

Measurements of stream ciphers on one machine: amd64; Ivy Bridge+AES (306a9); 2012 Intel Xeon E3-1275 V2; 4 x 3500MHz; `hydra8`, `supercop-20260217`