VAMPIRE	eBACS: ECRYPT Benchmarking of Cryptographic Systems	ECRYPT II

Measurements of public-key cryptosystems

[Page version: 20260221 06:44:50]

eBATS (ECRYPT Benchmarking of Asymmetric Systems) is a project to measure the performance of public-key systems. This page presents benchmark results collected in eBATS for public-key encryption:

• Time (cycles) to generate a key pair: a secret key and a corresponding public key.
• Time to encrypt a short message (59 bytes).
• Time to decrypt a short message, i.e., to recover a short message from a (larger) ciphertext.
• Space (bytes) for a secret key.
• Space for a public key.
• Ciphertext length for a 0-byte message.
• Ciphertext overhead for a 23-byte message: the ciphertext length minus 23 bytes.
• Ciphertext overhead for a long message: the ciphertext length minus the message length.

Each table row lists the first quartile of many speed measurements (or StQ1 starting with supercop-20260214), the median of many speed measurements (or StQ2 starting with supercop-20260214), the third quartile of many speed measurements (or StQ3 starting with supercop-20260214), and the name of the primitive. Measurements with large interquartile range (or stabilized interquartile range) are indicated in red with question marks. The symbol C: means that the current SUPERCOP database does not list IND-CCA2 security as a goal for this public-key cryptosystem. The symbol T: (starting with supercop-20200816) means that the SUPERCOP database at the time of benchmarking did not list constant time as a goal for this implementation. The symbol T!!! means that constant time was listed as a goal for this implementation, but that the implementation failed TIMECOP. (TIMECOP failures are not necessarily security issues; they can sometimes be resolved by, e.g., declaring that a rejection-sampling condition is safe to declassify.)

There is a separate page with more information about each public-key cryptosystem and each implementation. Designers and implementors interested in submitting new public-key cryptosystems and new implementations of existing cryptosystems should read the call for submissions.

Version